Add DocuSign partner OAuth2 with PKCE and picker

DocuSign approved our partner integration, so the connector can now
complete a real OAuth2 authorization-code flow. The integration key
has PKCE enabled, so RequiresPKCE is set; the confidential grant still
authenticates the token exchange with Basic auth and replays the
verifier as the documented hardening layer.

A DocuSign user may have access to several accounts, so this replaces
the previous auto-default-account behavior with a Pattern-1 picker:
the user chooses the account after OAuth, the choice is stored on
DocuSignConnectorSettings, and the driver and name resolver resolve
the selected account's data-center base URI from /oauth/userinfo.

Other changes:
- Request the extended scope so the refresh token's 30-day window
  rolls on each use; without it the token hard-expires 30 days after
  consent and breaks the connection.
- Drop API-key support: DocuSign has no static API key, only OAuth.
- Return ("", nil) from the name resolver on terminal failures so the
  source-name worker does not retry a revoked token forever.
- Add a driver test and cassette; the test previously skipped in CI
  for lack of a cassette.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/organizations.go

@@ -392,6 +392,30 @@ func ListNetlifyOrganizations(ctx context.Context, httpClient *http.Client) ([]O
 	return result, nil
 }
 
+// ListDocuSignOrganizations fetches the DocuSign accounts the authenticated
+// user can access, from the OAuth2 userinfo endpoint. A user may belong to
+// several accounts; the picker scopes the access source to one. The account
+// UUID is surfaced as the Organization slug (it is what the driver and name
+// resolver key off).
+func ListDocuSignOrganizations(ctx context.Context, httpClient *http.Client) ([]Organization, error) {
+	accounts, err := fetchDocuSignAccounts(ctx, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make([]Organization, len(accounts))
+	for i, a := range accounts {
+		displayName := a.AccountName
+		if displayName == "" {
+			displayName = a.AccountID
+		}
+
+		result[i] = Organization{Slug: a.AccountID, DisplayName: displayName}
+	}
+
+	return result, nil
+}
+
 // ListClickUpOrganizations fetches the ClickUp teams (workspaces) the
 // authenticated user belongs to.
 func ListClickUpOrganizations(ctx context.Context, httpClient *http.Client) ([]Organization, error) {