fix(KAAP-2257): separate public redirect host from internal API host

[mridulgain]

Summary

• LoginURL() was building the Shibboleth SSO redirect from FederationConfig.Host which is fine for SAAS. But for onprem/ce the internal Keystone Service URL is used which breaks the SSO redirection on browser (KAAP-2257).
• Adds optional ExternalHost (externalKeystoneHost), used only for the redirect, falling back to Host for backward compatibility. Server-to-server Keystone API calls still use Host.

Test plan

• go test ./connector/keystone/...
• e2e - failed

Testing: after upgrading the config & dex image

1. Use externally resolvable host name in browser:

Screen.Recording.2026-09-03.at.12.15.54.PM.mov

2. Usage of internal svc: during kubectl oidc login, logs from getKeystoneTokenFromFederation(), which builds its request from c.cfg.Host):

level=DEBUG msg="dex callback received" method=GET
level=DEBUG msg="getting keystone token from federation cookies"
level=DEBUG msg="requesting keystone token from federation auth endpoint"
..
time=2026-09-03T18:01:13.318Z level=ERROR msg="failed to authenticate" err="no X-Subject-Token found in federation auth response" request_id=89ba17e4-2046-4a74-964c-404291744263

But the keystone refuses to honor token request over unsecured http connection

[vaibhavd21]

For existing customers ? -

1. If they add externalKeystoneHost in dex config and update the dex image it starts working
2. Or they upgrade to the release where we fixed this

[mridulgain]

For existing customers ? -

1. If they add externalKeystoneHost in dex config and update the dex image it starts working
2. Or they upgrade to the release where we fixed this

Yes, if you o 1, it starts working. That's how I tested locally. However, the config is embedded in a secret which is generated & deployed by helm. So, recommended way is to upgrade the release.

[mridulgain]

The internal ep has two issues:

1. shibboleth config prevents session cookies sent over insecure (http) connections
2. internal keystone do have a https svc on port 15000, but another ca.cert mount would be needed & the external host is needed anyway for browser redirection.