Add Google Analytics, Dotfile, Segment and Square access-review connectors

Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/segment_test.go

@@ -0,0 +1,64 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSegmentDriver(t *testing.T) {
+	t.Parallel()
+
+	rec := newRecorder(t, "testdata/segment", "SEGMENT_API_TOKEN")
+	client := newVCRClient(rec, bearerAuth(os.Getenv("SEGMENT_API_TOKEN")))
+
+	driver := NewSegmentDriver(client, "https://api.segmentapis.com")
+	records, err := driver.ListAccounts(context.Background())
+	require.NoError(t, err)
+	require.Len(t, records, 3)
+
+	// First user: empty name falls back to email; Workspace Owner ⇒ admin.
+	owner := records[0]
+	assert.Equal(t, "sgJDWk3K21k6LE3tLU9nRK", owner.ExternalID)
+	assert.Equal(t, "papi@example.com", owner.Email)
+	assert.Equal(t, "papi@example.com", owner.FullName)
+	assert.True(t, owner.IsAdmin)
+	assert.Equal(t, []string{"Workspace Owner"}, owner.Roles)
+	require.NotNil(t, owner.Active)
+	assert.True(t, *owner.Active)
+
+	// Second user: named; resource-scoped read-only role ⇒ not admin.
+	member := records[1]
+	assert.Equal(t, "i2VTJURQprNfqdwjLFPWYx", member.ExternalID)
+	assert.Equal(t, "Sloth", member.FullName)
+	assert.False(t, member.IsAdmin)
+	assert.Equal(t, []string{"Source Read-only"}, member.Roles)
+	require.NotNil(t, member.Active)
+	assert.True(t, *member.Active)
+
+	// Pending invite: inactive, no roles, keyed by email.
+	invite := records[2]
+	assert.Equal(t, "foo@example.com", invite.Email)
+	assert.Equal(t, "foo@example.com", invite.ExternalID)
+	assert.False(t, invite.IsAdmin)
+	assert.Empty(t, invite.Roles)
+	require.NotNil(t, invite.Active)
+	assert.False(t, *invite.Active)
+}