Enforce oauth2.plugins.exclude live, with domain-level scoping

[Damans227]

Fixes #13859. Fixes #13860.

oauth2.plugins.exclude was only checked once, at Spring bean registration time, by ExtensionRegistry. A config change didn't take effect without a restart. Even a restart didn't reliably help. The exclude value may not be loaded from the DB yet when the registry beans initialize. The registry also has no concept of domain at all.

This replaces that with a live check in OAuth2AuthManagerImpl. It runs on every login/verify attempt instead of once at boot.

• isProviderExcluded(providerName, domainId) checks the global oauth2.plugins.exclude list first. If a domainId is given, it then checks a new domain-scoped override of the same key.
• oauth2.plugins.exclude is now ConfigKey.Scope.Domain (strict scope, no hierarchy walking). It can be set per domain in addition to globally.
• Domain-level exclude is additive only. A domain can exclude further providers on top of the global list. It can never un-exclude something the global list already excludes.
• getUserOAuth2AuthenticationProvider() gained a (providerName, domainId) overload. Both OAuth2UserAuthenticator.authenticate() and OAuth2AuthManagerImpl.verifySecretCodeAndFetchEmail() use it, since those are the two places that resolve a provider for an actual login attempt. The existing single-arg overload still exists. It delegates with domainId = null, global scope only.
• listUserOAuth2AuthenticationProviders() now filters out excluded providers too. listOauthProvider stops reporting an excluded provider as available.

Added test coverage for the union logic, the domain-scoped config key, and both call sites.

[Damans227]

@blueorangutan package

[blueorangutan]

@Damans227 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[codecov]

Codecov Report

❌ Patch coverage is 90.32258% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.91%. Comparing base (7ed0cec) to head (68a60b7).

Files with missing lines	Patch %	Lines
...pache/cloudstack/oauth2/OAuth2AuthManagerImpl.java	89.65%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #13867   +/-   ##
=========================================
  Coverage     19.91%   19.91%           
- Complexity    20198    20212   +14     
=========================================
  Files          6373     6373           
  Lines        577230   577257   +27     
  Branches      70696    70701    +5     
=========================================
+ Hits         114936   114981   +45     
+ Misses       449736   449712   -24     
- Partials      12558    12564    +6     

Flag	Coverage Δ
uitests	3.71% <ø> (ø)
unittests	21.19% <90.32%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18842

[DaanHoogland]

@blueorangutan test

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

[blueorangutan]

[SF] Trillian Build Failed (tid-16750)

[Damans227]

@blueorangutan package

[Damans227]

@kiranchavala can you review this? fixes #13859 and #13860 you raised