feat: support token auth for ManagedControlPlaneV2

[reshnm]

What this PR does / why we need it:

Previously it was only possible to configure a ManagedControlPlaneV2 IAM with OIDC.
This PR introduces a static token configuration for the IAM.
A user can provide a list of named static token configurations. For each configuration, the openmcp-operator will create a AccessRequest and writes the kubeconfig secret to ManagedControlPlaneV2 access map.
In the access map all tokens will be prefixed with token: and all oidc configs will be prefixed with oidc: to prevent name clashes.

In order to make it easier for the user to identify what field does what, the oidc configuration has been restureuctured.
The default providers role bindings are now under .spec.iam.oidc.defaultProvider.
Addition user specified OIDC providers are now specified under .spec.iam.oidc.extraProviders.

apiVersion: core.openmcp.cloud/v2alpha1
kind: ManagedControlPlaneV2
metadata:
  name: mcp-01
  namespace: foo
spec:
  iam:
    oidc:
      defaultProvider:
        roleBindings: # this sets the role bindings for the default OIDC provider (no effect if none is configured)
        - subjects:
          - kind: User
            name: john.doe@example.com
          roleRefs:
          - kind: ClusterRole
            name: cluster-admin
            
        extraProviders: # here, additional OIDC providers can be configured
        - name: my-oidc-provider
          issuer: https://oidc.example.com
          clientID: my-client-id
          extraScopes:
          - foo
          roleBindings:
          - subjects:
            - kind: User
              name: foo
            - kind: Group
              name: bar
            roleRefs:
            - kind: ClusterRole
              name: my-cluster-role
            - kind: Role
              name: my-role
              namespace: default
              
      tokens: # here, static tokens can be configured
      - name: admin # this token will be named 'admin' and must be unique per MCP
        # roleRefs and permissions can be either set individually or together
        roleRefs: # this sets the role bindings for the static token named 'admin'
          - kind: ClusterRole
            name: cluster-admin
        permissions: # here, additional permissions can be configured
          - rules:
              - apiGroups: [ '' ]
                resources: [ 'secretcs']
                verbs: [ '*' ]
      - name: viewer
        permissions:
          - rules:
              - apiGroups: [ '' ]
                resources: [ 'pods', 'services' ]
                verbs: [ 'get', 'list', 'watch' ]

Which issue(s) this PR fixes:
Fixes #260

Special notes for your reviewer:

Release note:

Allow static token configuration in IAM section of ManagedControlPlaneV2