feat: add Kubernetes OIDC DNS

[glitchedmob]

Routes k8s-oidc.sgf.dev to the SGF Devs Cloudflare Tunnel so the cluster can serve public OIDC discovery and JWKS.

• add a proxied CNAME for the Kubernetes issuer hostname
• reuse the tunnel target already discovered by the DNS stack

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-dns/actions/runs/33283311386

Show summary

CHANGE	RESOURCE
add (1)	module.sgf_dev.cloudflare_dns_record.core["k8s_oidc"]

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY