Consolidate connector provider dispatch behind a typed *Registry

The console previously dispatched per-provider logic through a fan of
init()-side-effect maps (driver names, OAuth2 metadata, probe URLs,
display names, settings switches), spread across pkg/connector,
pkg/accessreview/drivers and the console v1 resolvers. Adding a new
provider required edits in every one of those places and a corresponding
switch arm in CreateConnectorRequest. The same per-provider knowledge
also leaked into Helm templates as hand-rolled environment-variable
blocks per connector.

This commit collapses the dispatch surface into a single typed
*provider.Registry. The registry is constructed once by
NewBuiltinRegistry at probod startup and threaded as an explicit
dependency into every consumer (accessreview service, console v1
resolver, OAuth2 wiring). There is no package-level state. Each
provider lives in one file under pkg/connector/provider/ that exposes
a private xxxRegistration() *Registration constructor; NewBuiltinRegistry
enumerates them.

CreateConnectorRequest loses its per-provider settings fields and
takes a single RawSettings json.RawMessage produced by the
per-provider MarshalSettings closure. The 1Password SCIM bridge URL
is validated at create time (http(s) scheme + non-empty host) so a
malformed value fails fast at the resolver boundary. The Helm chart
gains probo.connectorEnv and probo.connectorSecretEntries templates
so adding a connector requires zero Helm changes. Access-review name
resolution moves into the same Registration value to keep one
authoritative dispatch table.

Tests cover every Registration (DisplayName, NewDriver wired),
Register error paths (nil, empty Provider, empty DisplayName,
duplicate), All / ProviderDisplayName / ProviderOAuth2Scopes /
ProbeURL hit and miss paths, the ApplyOAuth2Defaults templating and
PKCE branches, and ConnectorSettings[T] round-trip plus malformed-JSON
error path. The pre-refactor ApplyProviderDefaults test in
pkg/connector is replaced by the equivalent in
pkg/connector/provider.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/oauth2_test.go

@@ -699,66 +699,6 @@ func TestInitiateWithState_PKCE(t *testing.T) {
 	})
 }
 
-// TestApplyProviderDefaults_AuthURLTemplating verifies that operator-supplied
-// AuthURLParams (for example Vercel's "{integration_slug}") are substituted
-// into the static provider AuthURL when the connector is initialized.
-// Providers without placeholders are unaffected.
-func TestApplyProviderDefaults_AuthURLTemplating(t *testing.T) {
-	t.Parallel()
-
-	// Register a fake provider definition for the duration of this
-	// test so we do not have to wait for a real Vercel-style provider
-	// to land. Restore on teardown.
-	const fakeProvider = "TEST_TEMPLATED_AUTH_URL"
-
-	previous, hadPrevious := providerDefinitions[fakeProvider]
-	providerDefinitions[fakeProvider] = providerDefinition{
-		AuthURL:  "https://example.com/integrations/{integration_slug}/new",
-		TokenURL: "https://example.com/oauth/token",
-	}
-
-	t.Cleanup(func() {
-		if hadPrevious {
-			providerDefinitions[fakeProvider] = previous
-		} else {
-			delete(providerDefinitions, fakeProvider)
-		}
-	})
-
-	t.Run("placeholder is substituted when AuthURLParams is supplied", func(t *testing.T) {
-		t.Parallel()
-
-		c := &OAuth2Connector{
-			ClientID:     "id",
-			ClientSecret: "secret",
-			AuthURLParams: map[string]string{
-				"integration_slug": "acme",
-			},
-		}
-
-		ApplyProviderDefaults(fakeProvider, "https://example.com/cb", c)
-
-		assert.Equal(t, "https://example.com/integrations/acme/new", c.AuthURL)
-		assert.Equal(t, "https://example.com/oauth/token", c.TokenURL)
-	})
-
-	t.Run("placeholder remains literal when AuthURLParams is empty", func(t *testing.T) {
-		t.Parallel()
-
-		c := &OAuth2Connector{
-			ClientID:     "id",
-			ClientSecret: "secret",
-		}
-
-		ApplyProviderDefaults(fakeProvider, "https://example.com/cb", c)
-
-		// No substitution requested; the placeholder is preserved
-		// verbatim so a misconfiguration is visible at the
-		// authorization step rather than silently masked.
-		assert.Equal(t, "https://example.com/integrations/{integration_slug}/new", c.AuthURL)
-	})
-}
-
 // TestGeneratePKCEVerifier exercises the verifier generator: each call
 // must return a fresh value, encoded as RFC 4648 §5 base64url-without-
 // padding (RFC 7636 §4.1 mandates 43–128 unreserved chars; 32 bytes
@@ -788,24 +728,6 @@ func TestGeneratePKCEVerifier(t *testing.T) {
 	}
 }
 
-// TestApplyProviderDefaults_PKCEDefaults asserts that the registered
-// PAGERDUTY provider defaults flip RequiresPKCE on so the downstream
-// Initiate/Complete flow generates a verifier and replays it.
-func TestApplyProviderDefaults_PKCEDefaults(t *testing.T) {
-	t.Parallel()
-
-	for _, provider := range []string{"PAGERDUTY"} {
-		t.Run(provider, func(t *testing.T) {
-			t.Parallel()
-
-			c := &OAuth2Connector{ClientID: "id", ClientSecret: "secret"}
-			ApplyProviderDefaults(provider, "https://example.com/cb", c)
-			assert.True(t, c.RequiresPKCE,
-				"provider %s must enable PKCE so Initiate generates a verifier", provider)
-		})
-	}
-}
-
 // TestCompleteWithState_PKCEMismatch confirms that a token endpoint
 // rejecting a stale or mismatched code_verifier (the standard PKCE
 // failure path) surfaces as an error from CompleteWithState rather