test(features): port Keycloak provider refresh to testkit

Add a keycloak features crate with a suite-local KeycloakContext fixture
that reads OPENSHELL_TEST_KEYCLOAK_* and port the provider refresh test
onto it. Run it in the cpu-tests plan on the Docker + Keycloak
environment. The old provider-refresh crate stays until the required
lanes switch.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

tests/plans/cpu-tests.yaml

@@ -16,3 +16,9 @@ matrix:
   - type: conformance
     environments:
       - tmachine.ubuntu2404-amd64.docker-rootful.deb
+  # Suites that need Keycloak run where the environment provides it. List them
+  # by name, so a features suite that needs another service doesn't land here.
+  - type: features
+    suites: [provider-refresh]
+    environments:
+      - tmachine.ubuntu2404-amd64.docker-rootful.deb+keycloak