add MCP building blocks to backend library

[pmeier]

Per title. We can just use the default pydantic_ai.mcp.MCPToolset, but we have to add authentication on top of it. Assuming the MCP server validates incoming requests for a bearer token from any OpenID provider, we need two separate auth lanes:

1. MCP server setup for the initial tool discovery during the agent setup. This requires static credentials.
2. MCP calls originating from the user the run belongs to. This requires dynamic credentials on a per run basis.

This PR implements this scheme with an impersonating service account that has static credentials and is allowed to exchange its own credentials for any registered user.

On Keycloak this is a client with service account roles

and the service account having the impersonation role

A valid config can look like

agents:
  static:
    google-workspace:
      cls_or_fn: ravnar.agents.PydanticAiAgentWrapper
      params:
        agent:
          cls_or_fn: pydantic_ai.Agent
          params:
            model:
              cls_or_fn: pydantic_ai.models.google.GoogleModel
              params:
                model_name: gemini-flash-latest
                provider:
                  cls_or_fn: pydantic_ai.providers.google.GoogleProvider
                  params:
                    api_key: '{{ include "ravnar.env.templateLiteral" "GOOGLE_API_KEY" }}'
            name: Frames Agent
            toolsets:
              - cls_or_fn: ravnar_nebari_mcp.ImpersonatingMCPToolset
                params:
                  mcp_toolset_factory:
                    cls_or_fn: ravnar_nebari_mcp.bearer_token_mcp_toolset_factory
                    params:
                      url: http://my-mcp-server.com
                  impersonator:
                    cls_or_fn: ravnar_nebari_mcp.OIDCImpersonator
                    params:
                      issuer: http://keycloak-keycloakx-http.keycloak.svc.cluster.local:8080/realms/nebari
                      client_id: '{{ include "ravnar.env.templateLiteral" "IMPERSONATOR_CLIENT_ID" }}'
                      client_secret: '{{ include "ravnar.env.templateLiteral" "IMPERSONATOR_CLIENT_SECRET" }}'

where IMPERSONATOR_CLIENT_ID and IMPERSONATOR_CLIENT_SECRET are the static credentials of the Keycloak client above.

[jbouder]

Amazing work, thank you! Approved