Manage the CCCHH browser authentication flow as YAML

Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.

resources/chaosknoten/keycloak/auth_flows/browser.yaml

@@ -0,0 +1,62 @@
+---
+realm: ccchh
+alias: browser passkey and token
+description: passkey or (password and (TOTP or token))
+providerId: basic-flow
+authenticationExecutions:
+  - providerId: auth-cookie
+    requirement: ALTERNATIVE
+  - providerId: auth-spnego
+    requirement: DISABLED
+  - providerId: identity-provider-redirector
+    requirement: ALTERNATIVE
+  - subFlow: browser passkey and token browser passkey Organization
+    requirement: DISABLED
+    authenticationExecutions:
+      - subFlow: browser passkey and token browser passkey Browser - Conditional Organization
+        requirement: CONDITIONAL
+        authenticationExecutions:
+          - providerId: conditional-user-configured
+            requirement: REQUIRED
+          - providerId: organization
+            requirement: ALTERNATIVE
+  - subFlow: browser passkey and token browser passkey forms
+    requirement: ALTERNATIVE
+    authenticationExecutions:
+      - subFlow: browser passkey and token Passkey or Password
+        requirement: REQUIRED
+        authenticationExecutions:
+          - providerId: webauthn-authenticator-passwordless
+            requirement: ALTERNATIVE
+          - subFlow: browser passkey and token Password + OTP
+            requirement: ALTERNATIVE
+            authenticationExecutions:
+              - providerId: auth-username-password-form
+                requirement: REQUIRED
+              - subFlow: browser passkey and token Conditional OTP
+                requirement: CONDITIONAL
+                authenticationExecutions:
+                  - providerId: conditional-credential
+                    requirement: REQUIRED
+                    authenticationConfig:
+                      alias: browser passkey and token not passkey
+                      config:
+                        credentials: webauthn-passwordless
+                        included: 'false'
+                  - providerId: conditional-user-configured
+                    requirement: REQUIRED
+                  - providerId: auth-otp-form
+                    requirement: REQUIRED
+              - subFlow: WebAuthn Authenticator if configured for the user
+                requirement: CONDITIONAL
+                authenticationExecutions:
+                  - providerId: conditional-credential
+                    requirement: REQUIRED
+                    authenticationConfig:
+                      alias: webauthn-passwordless
+                      config:
+                        credentials: webauthn-passwordless
+                  - providerId: conditional-user-configured
+                    requirement: REQUIRED
+                  - providerId: webauthn-authenticator
+                    requirement: REQUIRED