Keycloak integration first pass

[danlester]

Addresses most of #780 (Authentication via Keycloak) - let's review any outstanding items there to see if still relevant after trying this branch out.

We then need to consider #835 (Keycloak - how to upgrade existing QHubs).

And need to completely rework the documentation.

Also provides an 'extension mechanism' from the YAML:

extensions:
  - name: ent-control-panel
    image: quansight/my-image:9
    urlslug: myurl
    private: false
    oauth2client: true
    logout: /logout
    envs:
      - code: KEYCLOAK
      - code: OAUTH2CLIENT
      - code: JWT