Add OIDC authentication support to Doppler provider

[mikesellitto]

Problem Statement

The Doppler provider in ESO currently only supports token-based authentication. Doppler has added OIDC authentication functionality to their product, but ESO currently has no simple way to utilize it.

Related Issue

Fixes #XXXX

Proposed Changes

This PR adds OIDC authentication support to the Doppler provider, allowing ESO to authenticate with Doppler without using static credentials.

Specifically, it:

• Adds a new oidcConfig field to the Doppler provider's auth config (mutually exclusive with the existing secretRef auth).
• Adds a new --doppler-oidc-cache-size flag, which controls the LRU cache size for OIDC-authenticated Doppler clients.

Checklist

• I have read the contribution guidelines
• All commits are signed with git commit --signoff
• My changes have reasonable test coverage
• All tests pass with make test
• I ensured my PR is ready for review with make reviewable

[emily-curry]

Some initial observations. I have not tested locally yet, but I will later today.

[emily-curry]

I tested this pretty lightly, but it seems solid. Did not test the clusterSecretStore.

Let's not merge this into our fork's main branch. Instead, you can retarget this at a feature branch, and use that for opening the PR upstream, or you can use your own fork for opening the PR. It would be easiest to keep this fork's main branch 1:1 with upstream, though.

[emily-curry]

question: Could you explain why this is necessary (and perhaps add a comment)?

[mikesellitto]

By default, we look for the ServiceAccount in the ExternalSecrets namespace. For ClusterSecretStores which can be used across namespaces, we allow explicitly specifying which namespace the ServiceAccount lives in via ServiceAccountRef.Namespace.

I've added this comment in the latest force push:
// For ClusterSecretStores, we use the ServiceAccountRef.Namespace if specified
I could get more specific, but I feel like this is enough to make sense of for reviewers/users who are using a ClusterSecretStore

[emily-curry]

check/question: Why is this part necessary? It doesn't look like we were doing this before.

[mikesellitto]

This part is necessary because this DopplerToken is what we use when making requests.

However, you brought my attention to the fact that I was setting c.dopplerToken = token above this, which wasn't necessary since it's only used during initialization of the DopplerClient. That's been removed in the latest force push.

[emily-curry]

nit/optional: We should probably disambiguate any references to caches and keys by including auth/oidc somewhere in the name, in anticipation of also caching secret values.

[mikesellitto]

Good thinking. Done in the latest force push.

[emily-curry]

nit/check: Can we hoist the && clientCache != nil check into useCache?

[mikesellitto]

Yep! Done in the latest force push.

[watsonian]

Could we explain this in terms of a template as well as provide concrete examples? (i.e., secretStore:<namespace>:<secretStoreName> and system:serviceaccount:<namespace>:<serviceAccountName>)

[watsonian]

Left one comment regarding a slight tweak to the docs I think we should make, but otherwise confirmed everything was working as expected in a local build.