Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

.env.example

@@ -124,6 +124,9 @@
 # CONNECTOR_MONDAY_CLIENT_SECRET=
 # CONNECTOR_DATADOG_CLIENT_ID=
 # CONNECTOR_DATADOG_CLIENT_SECRET=
+# Zendesk OAuth requires a Zendesk-approved global OAuth client (Marketplace).
+# CONNECTOR_ZENDESK_CLIENT_ID=
+# CONNECTOR_ZENDESK_CLIENT_SECRET=
 # PostHog Cloud (US + EU) OAuth needs NO config: it uses the CIMD public-client
 # flow (no app registration, no client_secret), auto-enabled when this
 # deployment is publicly reachable at PROBOD_BASE_URL. Self-hosted PostHog uses