Add Microsoft 365 SCIM bridge and access review driver

Microsoft 365's native SCIM endpoint is unreliable, so mirror the
Google Workspace bridge over Microsoft Graph: a new MICROSOFT_365
OAuth2 connector, a SCIM bridge provider listing /v1.0/users with
$select pagination, and an access review driver that derives admin
status from /directoryRoles members. Refactor the bridge runner to
share OAuth2 plumbing across providers and surface the new bridge
type, scopes, UI card, and bootstrap env wiring.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/connector_provider.go

@@ -26,19 +26,20 @@ const (
 	ConnectorProviderGoogleWorkspace ConnectorProvider = "GOOGLE_WORKSPACE"
 	ConnectorProviderLinear          ConnectorProvider = "LINEAR"
 	// _ ConnectorProvider = "FIGMA" — formerly Figma; removed (no driver, no OAuth config, no usage)
-	ConnectorProviderOnePassword ConnectorProvider = "ONE_PASSWORD"
-	ConnectorProviderHubSpot     ConnectorProvider = "HUBSPOT"
-	ConnectorProviderDocuSign    ConnectorProvider = "DOCUSIGN"
-	ConnectorProviderNotion      ConnectorProvider = "NOTION"
-	ConnectorProviderBrex        ConnectorProvider = "BREX"
-	ConnectorProviderTally       ConnectorProvider = "TALLY"
-	ConnectorProviderCloudflare  ConnectorProvider = "CLOUDFLARE"
-	ConnectorProviderOpenAI      ConnectorProvider = "OPENAI"
-	ConnectorProviderSentry      ConnectorProvider = "SENTRY"
-	ConnectorProviderSupabase    ConnectorProvider = "SUPABASE"
-	ConnectorProviderGitHub      ConnectorProvider = "GITHUB"
-	ConnectorProviderIntercom    ConnectorProvider = "INTERCOM"
-	ConnectorProviderResend      ConnectorProvider = "RESEND"
+	ConnectorProviderOnePassword  ConnectorProvider = "ONE_PASSWORD"
+	ConnectorProviderHubSpot      ConnectorProvider = "HUBSPOT"
+	ConnectorProviderDocuSign     ConnectorProvider = "DOCUSIGN"
+	ConnectorProviderNotion       ConnectorProvider = "NOTION"
+	ConnectorProviderBrex         ConnectorProvider = "BREX"
+	ConnectorProviderTally        ConnectorProvider = "TALLY"
+	ConnectorProviderCloudflare   ConnectorProvider = "CLOUDFLARE"
+	ConnectorProviderOpenAI       ConnectorProvider = "OPENAI"
+	ConnectorProviderSentry       ConnectorProvider = "SENTRY"
+	ConnectorProviderSupabase     ConnectorProvider = "SUPABASE"
+	ConnectorProviderGitHub       ConnectorProvider = "GITHUB"
+	ConnectorProviderIntercom     ConnectorProvider = "INTERCOM"
+	ConnectorProviderResend       ConnectorProvider = "RESEND"
+	ConnectorProviderMicrosoft365 ConnectorProvider = "MICROSOFT_365"
 )
 
 func ConnectorProviders() []ConnectorProvider {
@@ -59,6 +60,7 @@ func ConnectorProviders() []ConnectorProvider {
 		ConnectorProviderGitHub,
 		ConnectorProviderIntercom,
 		ConnectorProviderResend,
+		ConnectorProviderMicrosoft365,
 	}
 }
 
@@ -110,6 +112,8 @@ func (cp *ConnectorProvider) Scan(value any) error {
 		*cp = ConnectorProviderIntercom
 	case "RESEND":
 		*cp = ConnectorProviderResend
+	case "MICROSOFT_365":
+		*cp = ConnectorProviderMicrosoft365
 	default:
 		return fmt.Errorf("invalid ConnectorProvider value: %q", s)
 	}

pkg/coredata/scim_bridge_type.go

@@ -23,6 +23,7 @@ type SCIMBridgeType string
 
 const (
 	SCIMBridgeTypeGoogleWorkspace SCIMBridgeType = "GOOGLE_WORKSPACE"
+	SCIMBridgeTypeMicrosoft365    SCIMBridgeType = "MICROSOFT_365"
 )
 
 func (t SCIMBridgeType) String() string {
@@ -43,6 +44,8 @@ func (t *SCIMBridgeType) Scan(value any) error {
 	switch str {
 	case "GOOGLE_WORKSPACE":
 		*t = SCIMBridgeTypeGoogleWorkspace
+	case "MICROSOFT_365":
+		*t = SCIMBridgeTypeMicrosoft365
 	default:
 		return fmt.Errorf("invalid SCIMBridgeType value: %q", str)
 	}