fix: use tls config from BTP when connecting to the OIDC provider's well-known endpoint.

[zhaohuabing]

Fixes #4838

Release Notes: Yes

[codecov]

Codecov Report

Attention: Patch coverage is 40.00000% with 51 lines in your changes missing coverage. Please review.

Project coverage is 66.22%. Comparing base (ca2d80b) to head (88a3e09).

Files with missing lines	Patch %	Lines
internal/ir/xds.go	0.00%	37 Missing ⚠️
internal/gatewayapi/securitypolicy.go	70.83%	10 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4857      +/-   ##
==========================================
- Coverage   66.29%   66.22%   -0.08%     
==========================================
  Files         209      209              
  Lines       32035    32097      +62     
==========================================
+ Hits        21239    21255      +16     
- Misses       9536     9580      +44     
- Partials     1260     1262       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[zhaohuabing]

Removing tokenEndpoint and authorizationEndpoint so they will be fetched by the Gateway API translator. This is used to verify that EG uses the CA from BackendTLSPolicy when connecting to the OIDC provider's well-known endpoint.

[zhaohuabing]

Using curl instead of nc to verify that keycload is ready. This change fixed some flaky OIDC tests.

[arkodg]

see test/e2e/testdata/oidc-securitypolicy-backendcluster.yaml being updated but not in use

[zhaohuabing]

It's used here:

Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
		t.Run("oidc provider represented by a BackendCluster", func(t *testing.T) {
			testOIDC(t, suite, "testdata/oidc-securitypolicy-backendcluster.yaml")

The creation of SecurityPolicy is now started after keycloak pod is ready, so EG can fetch the auth and token points from the keycloak's well-known endpoint.