feat(keycloak): deploy token broker from reusable module

[jmgilman]

Summary

• deploy the GitHub token broker from the reusable meigma/github-token-broker Terraform module inside the Keycloak AWS stack
• grant the Keycloak EC2 role permission to invoke the broker Lambda
• document targeted retirement of the legacy aws/github-token-broker Lambda resources while preserving the lab GitHub Actions OIDC provider

Notes

• Module source and Lambda artifact are pinned to meigma/github-token-broker v2.0.0.
• Live lab AWS has been applied from this branch: old legacy Lambda resources were removed, the Keycloak-owned broker Lambda was created, and the Lambda was updated in place to v2.0.0.
• Upstream broker PR fix(terraform): support AWS provider v5 region data meigma/github-token-broker#33 is merged, and release PR chore(master): release 2.0.0 meigma/github-token-broker#32 produced published release https://github.com/meigma/github-token-broker/releases/tag/v2.0.0.

Testing

• just check in aws/keycloak
• tofu plan -detailed-exitcode in aws/keycloak after apply: no changes
• invoked glab-github-token-broker with null payload after the v2.0.0 update; response minted a token for GilmanLab/secrets with contents: read and no function error
• used the minted token to call gh api repos/GilmanLab/secrets without printing the token value
• verified the v2.0.0 release with gh release verify, checksum validation, and gh attestation verify