feat(keycloak): add Incus OIDC client

[jmgilman]

Summary

• add a public incus OIDC client to the Keycloak lab realm
• enable OAuth 2.0 Device Authorization Grant and keep unused grants disabled
• replace the one-shot realm import marker with a rendered config hash marker

Testing

• cd aws/keycloak && just check
• moon run aws-keycloak:check --summary minimal
• jq empty aws/keycloak/templates/keycloak/lab-realm.json.tftpl
• git diff --check