feat(keycloak): configure local WebAuthn admin

[jmgilman]

Summary

• add first-boot Keycloak lab realm configuration with keycloak-config-cli
• create one local admin account from SOPS-fetched runtime env and require WebAuthn registration
• keep the GitHub token broker bootstrap path unchanged
• add a manual service to disable the temporary master bootstrap admin after YubiKey validation

Validation

• TF_PLUGIN_CACHE_DIR=/Users/josh/code/glab/infra/aws/lab-foundation/.terraform/providers ./scripts/check.sh
• git diff --check

Notes

The expanded Ignition payload is embedded through Ignition's gzip config.replace wrapper so EC2 user_data stays below the 16 KiB limit.