Migrate IdP-hint and nonce-parameter broker tests - #52379

Migrate KcOidcBrokerJWETest (1 own test), KcOidcBrokerJWEUserInfoJustEncryptedTest,
and all 8 ECDH-ES variant tests, all landing in oidc/.

Architecture change from the phase-2 branch: the phase-2/interim design used
interface traits (JweBrokerConfigSupport, EcdhEsJweBrokerConfigSupport,
JweUserInfoBrokerTest) because that's how the whole shared support layer was
built at the time. Converted to a 2-layer abstract-class extension instead -
AbstractKcOidcJweBrokerTest extends AbstractKcOidcBrokerTest (JWE key/algorithm
config + the shared testIdentityClaimsFromUserInfoEndpoint()), and
AbstractKcOidcEcdhEsJweBrokerTest extends AbstractKcOidcJweBrokerTest
(ECDH-specific key overrides + abstract getCurve()) - rather than keeping them
as interfaces mixed in alongside BrokerLoginTest/EcdhEsJweBrokerConfigSupport.

Re-examined whether this is genuinely a "multi-axis" case (the documented
reason interfaces are reserved over abstract classes elsewhere in this
migration): it isn't. Every one of the 10 variants wants the full stack -
protocol config, basic login tests, and JWE support - in the same order, with
no case needing to skip a layer (unlike e.g. KcOidcBrokerHiddenIdpHintTest in
chain expresses this without forcing AbstractBrokerTest's protected
fields/methods (oauth, webDriver, logInAsUserInIDP(), etc.) to be widened to
public just so interface default methods could call them - interface methods
are implicitly public, and a protected inherited method does not satisfy a
public abstract interface method, so keeping these as interfaces against the
current abstract-class baseline would have forced that wider visibility
change. Concrete classes drop straight to their per-variant algorithm/curve
overrides (4 one-line methods, or none at all for the RSA base case).

Also removes the legacy AbstractKcOidcBrokerJWEEcdhEsTest shared base (all 8
subclasses migrated) and drops all 10 now-migrated class names from the
legacy fips-suite list (they are not yet added to the new-testsuite FIPS
suites - already tracked separately as deferred pending a test-framework
HTTPS-trust fix, per the migration plan's Infrastructure section).

Found and fixed another real gap in the merged AbstractBrokerTest (same
category as keycloak#52244's disableUpdateProfileOnFirstLogin): enableUnmanagedAttributes()
was dropped during the abstract-class rework. Without it, the declarative user
profile silently drops attributes outside its managed schema - exactly what
this batch's IdP mapper does (maps a custom OIDC claim onto a "user-info" user
attribute), so testIdentityClaimsFromUserInfoEndpoint failed identically
across all 10 variants until this was restored. Caught by running the tests,
not by inspection.

Carries forward the visibility widening + configureBrokerEndpoints() and
assertUserCreatedInConsumerRealm() fixes from keycloak#52372/keycloak#52376/keycloak#52379
(independently re-derived per batch, this branch is off upstream/main).

Closes keycloak#52245

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>

Migrate KcOidcBrokerJWETest (1 own test), KcOidcBrokerJWEUserInfoJustEncryptedTest,
and all 8 ECDH-ES variant tests, all landing in oidc/.

Architecture change from the phase-2 branch: the phase-2/interim design used
interface traits (JweBrokerConfigSupport, EcdhEsJweBrokerConfigSupport,
JweUserInfoBrokerTest) because that's how the whole shared support layer was
built at the time. Converted to a 2-layer abstract-class extension instead -
AbstractKcOidcJweBrokerTest extends AbstractKcOidcBrokerTest (JWE key/algorithm
config + the shared testIdentityClaimsFromUserInfoEndpoint()), and
AbstractKcOidcEcdhEsJweBrokerTest extends AbstractKcOidcJweBrokerTest
(ECDH-specific key overrides + abstract getCurve()) - rather than keeping them
as interfaces mixed in alongside BrokerLoginTest/EcdhEsJweBrokerConfigSupport.

Re-examined whether this is genuinely a "multi-axis" case (the documented
reason interfaces are reserved over abstract classes elsewhere in this
migration): it isn't. Every one of the 10 variants wants the full stack -
protocol config, basic login tests, and JWE support - in the same order, with
no case needing to skip a layer (unlike e.g. KcOidcBrokerHiddenIdpHintTest in
chain expresses this without forcing AbstractBrokerTest's protected
fields/methods (oauth, webDriver, logInAsUserInIDP(), etc.) to be widened to
public just so interface default methods could call them - interface methods
are implicitly public, and a protected inherited method does not satisfy a
public abstract interface method, so keeping these as interfaces against the
current abstract-class baseline would have forced that wider visibility
change. Concrete classes drop straight to their per-variant algorithm/curve
overrides (4 one-line methods, or none at all for the RSA base case).

Also removes the legacy AbstractKcOidcBrokerJWEEcdhEsTest shared base (all 8
subclasses migrated) and drops all 10 now-migrated class names from the
legacy fips-suite list (they are not yet added to the new-testsuite FIPS
suites - already tracked separately as deferred pending a test-framework
HTTPS-trust fix, per the migration plan's Infrastructure section).

Found and fixed another real gap in the merged AbstractBrokerTest (same
category as #52244's disableUpdateProfileOnFirstLogin): enableUnmanagedAttributes()
was dropped during the abstract-class rework. Without it, the declarative user
profile silently drops attributes outside its managed schema - exactly what
this batch's IdP mapper does (maps a custom OIDC claim onto a "user-info" user
attribute), so testIdentityClaimsFromUserInfoEndpoint failed identically
across all 10 variants until this was restored. Caught by running the tests,
not by inspection.

Carries forward the visibility widening + configureBrokerEndpoints() and
assertUserCreatedInConsumerRealm() fixes from #52372/#52376/#52379
(independently re-derived per batch, this branch is off upstream/main).

Closes #52245

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>