tf/keycloak: Add openid client for buildbot

The buildbot POC wants to use Keycloak for user authentication. The client is public, because it doesn't make sense to have a client secret, which can't be kept under wrap anyway (it would need to be shipped with the CLI[1]).

[1] https://gitlab.archlinux.org/foxboron/buildctl