WIP Migrate KKP dashboard auth from implicit flow to OAuth authorization code flow

[ahmadhamzh]

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #7940

What type of PR is this?
/kind design

Special notes for your reviewer:

Does this PR introduce a user-facing change? Then add your Release Note here:

Documentation:

[kubermatic-bot]

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kubermatic-bot]

@ahmadhamzh: Adding the "do-not-merge/docs-needed" label because no documentation block was detected, please follow our documentation process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ahmadhamzh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• modules/api/OWNERS
• modules/api/pkg/OWNERS
• modules/api/pkg/handler/OWNERS
• modules/web/src/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ahmadhamzh]

Changed -oidc-authenticator-client-id from kubermatic to kubermaticIssuer
because the new auth code flow issues tokens using the issuer client (kubermaticIssuer).
The token verifier must use the same client ID to accept these tokens (audience claim must match).
The old kubermatic public client was only needed for the implicit flow which is being removed.

[kubermatic-bot]

@ahmadhamzh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pre-dashboard-api-lint	888a105	link	true	/test pre-dashboard-api-lint
pre-dashboard-web-integration-tests-ce	888a105	link	true	/test pre-dashboard-web-integration-tests-ce
pre-dashboard-web-integration-tests	888a105	link	true	/test pre-dashboard-web-integration-tests
pre-dashboard-web-unit	888a105	link	true	/test pre-dashboard-web-unit

Full PR test history

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.