feat: support AWS Cognito as an OIDC provider for external-idp

[rhartuv]

Summary

• Add AWS Cognito support on the existing external-idp profile (no new Quarkus profile).
• Map browser-login roles from the cognito:groups JWT claim in RoleMappingAugmentor.
• Add optional exploitiq.security.oidc.scope-role-mappings for Cognito M2M (client_credentials) tokens that have no group claim, so agents can be authorized as exploitiq-api-access.
• Document required Cognito env vars in application.properties.
• Add unit tests for Cognito claim mapping and non-regression of OpenShift/Keycloak/k8s SA paths.

Out of scope

• exploit-iq-agent / vulnerability-analysis Cognito token client (separate repo).
• Changes to OpenShift prod or Keycloak flows.

Test plan

• mvn test -Dtest=RoleMappingAugmentorTest,RoleMappingAugmentorScopeMappingsUnconfiguredTest
• Local QUARKUS_PROFILE=dev,external-idp with real Cognito User Pool: browser login works and roles from Cognito groups authorize the UI
• Confirm Keycloak/prod behavior unchanged when Cognito env vars / scope mappings are unset
• (Optional) M2M: Cognito client_credentials token with configured scope mapping can call the API as exploitiq-api-access

Jira

Screencast.From.2026-08-02.11-00-38.mp4

[vbelouso]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.