tf/keycloak: Add openid client for buildbot

The buildbot POC wants to use Keycloak for user authentication. The client is public, because it doesn't make sense to have a client secret, which can't be kept under wrap anyway (it would need to be shipped with the CLI[1]).

[1] https://gitlab.archlinux.org/foxboron/buildctl

group_vars/all/vault_buildbot.yml

+$ANSIBLE_VAULT;1.1;AES256
+32373737633438376238336131346133613965666235373532646132633563613332613866633235
+3966326562306136333437343563363532666465663861650a306262653565626365393533326462
+34633166373565663765303064393732316331366336613463346261373038373336373933663766
+3936306362336265310a386165633833393038366263613663346163386163373432316566386339
+30653134623639663439376566613631363162313263636636643461383461316565353364343865
+65363066363932383862623562343664356363626639626136326562316639616434373034663432
+37636364383763613438383361333863303330383339656262356433613061343432366164613762
+36363130656561383863