Add Zendesk access-review connector

Zendesk is a multi-tenant OAuth connector keyed by the customer
subdomain. The customer enters it at connect time; it rides the signed
state to the callback, is re-validated, and is stored on the connector
settings to build the API host.

List staff (agents and admins) via GET /api/v2/users.json with cursor
pagination, mapping role, active/suspended, and 2FA status; end-users
are excluded. The subdomain is validated as a single DNS label at every
trust boundary to close the SSRF vector, and the data client keeps the
SSRF-protected transport.

Zendesk OAuth across customer subdomains requires a Zendesk-approved
global OAuth client; the connector goes live once those credentials are
supplied via bootstrap.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/server/api/console/v1/access_source_provider_config.go

@@ -131,4 +131,12 @@ var providerOrgConfigs = map[coredata.ConnectorProvider]providerOrgConfig{
 			return s.Domain
 		},
 	},
+	// Pattern 2-auto: the subdomain is collected at initiate and persisted
+	// from the signed OAuth state on the callback; no picker UI.
+	coredata.ConnectorProviderZendesk: {
+		SelectedSlug: func(c *coredata.Connector) string {
+			s, _ := coredata.ConnectorSettings[coredata.ZendeskConnectorSettings](c)
+			return s.Subdomain
+		},
+	},
 }