fix(test): drop IPv6 loopback redirect from the Keycloak fixture realm (#5089)

Keycloak 24 rejects http://[::1]:* (and every other port wildcard on an
IPv6 literal) when importing the realm, so it fails to start with
"Invalid client openshell-cli: A redirect URI is not a valid URI". That
broke every lane that loads scripts/keycloak-realm.json, including the
features/keycloak suite and the OIDC Docker E2E jobs.

Restore the IPv4 loopback and localhost entries only, and correct the
authentication docs: IPv6 callback binds against the bundled realm need
an exact http://[::1]:<port>/callback redirect URI.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

docs/how-it-works/gateways/authentication.mdx

@@ -343,7 +343,7 @@ For example, a wrapper running the CLI in a container sets both variables and pu
 OPENSHELL_CALLBACK_PORT=18080 OPENSHELL_CALLBACK_BIND_ADDRESS=0.0.0.0 openshell gateway login
 ```
 
-The browser-facing callback URL derives from the bound address, so the callback matches the listener: IPv4 binds (including the default and `0.0.0.0`) use `http://127.0.0.1:<port>/callback`, and IPv6 binds use the bracketed RFC 8252 loopback form `http://[::1]:<port>/callback`. The bundled Keycloak realm allows `http://127.0.0.1:*`, `http://localhost:*`, and `http://[::1]:*` redirects for the CLI client; other identity providers that allowlist loopback redirects for native apps should include the `[::1]` form as well.
+The browser-facing callback URL derives from the bound address, so the callback matches the listener: IPv4 binds (including the default and `0.0.0.0`) use `http://127.0.0.1:<port>/callback`, and IPv6 binds use the bracketed RFC 8252 loopback form `http://[::1]:<port>/callback`. Identity providers that allowlist loopback redirects for native apps must include the `[::1]` form for IPv6 binds. The bundled Keycloak realm allows only `http://127.0.0.1:*` and `http://localhost:*`, because Keycloak rejects a port wildcard on an IPv6 literal, so IPv6 binds against it need an exact `http://[::1]:<port>/callback` redirect URI added to the `openshell-cli` client.
 
 **IPv6 limitation for edge login:** IPv6 callback binds are fully supported for OIDC login, but the edge browser flow has a known browser limitation. The gateway's connect page enforces a Content-Security-Policy that must allow the callback target, and Chrome does not currently support IPv6 literals in CSP `connect-src` source expressions. An IPv6-bound CLI (`OPENSHELL_CALLBACK_BIND_ADDRESS=::1` or `::`) therefore cannot complete edge login in Chrome: the page's POST to the callback is blocked by CSP and the page reports that it could not reach the CLI. This is a browser limitation, not a CLI or gateway defect; IPv6 edge login is best-effort until browsers implement IPv6 CSP source expressions. The IPv4 paths, including the container use case, are unaffected.
 

scripts/keycloak-realm.json

@@ -288,8 +288,8 @@
       "standardFlowEnabled": true,
       "directAccessGrantsEnabled": true,
       "serviceAccountsEnabled": false,
-      "redirectUris": ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-      "webOrigins": ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+      "redirectUris": ["http://127.0.0.1:*", "http://localhost:*"],
+      "webOrigins": ["http://127.0.0.1:*", "http://localhost:*"],
       "attributes": {
         "pkce.code.challenge.method": "S256"
       },