Manage the CCCHH browser authentication flow as YAML

Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.

roles/keycloak_auth_flow/meta/argument_specs.yaml

@@ -0,0 +1,24 @@
+---
+argument_specs:
+  main:
+    options:
+      keycloak_auth_flow__flows:
+        description: >-
+          List of authentication flow definitions to validate and deploy. Each item needs
+          C(realm), C(alias) and C(authenticationExecutions) (nested tree, see
+          middleware_automation.keycloak.keycloak_authentication_v2), and may set C(providerId)
+          and C(description).
+        type: list
+        elements: dict
+      keycloak_auth_flow__admin_url:
+        description: Base URL of the Keycloak Admin REST API.
+        type: str
+        default: "http://127.0.0.1:8080"
+      keycloak_auth_flow__admin_username:
+        description: Username of a Keycloak admin (in the C(master) realm) used to manage flows.
+        type: str
+        default: admin
+      keycloak_auth_flow__admin_password:
+        description: Password for O(keycloak_auth_flow__admin_username).
+        type: str
+        required: true