feat: activate Kubernetes OIDC issuer

[glitchedmob]

Changes the default issuer for newly minted SGF K3s service-account tokens to the public OIDC endpoint while preserving validation compatibility with the existing internal issuer.

• configure https://k8s-oidc.sgf.dev as the first service-account issuer
• retain the internal Kubernetes issuer as the secondary accepted issuer
• publish the public JWKS URI through the API server discovery document
• centralize K3s server configuration while preserving architecture-specific node labels

[glitchedmob]

After merge, apply the issuer configuration from the repository root:

make ansible PLAYBOOK=cluster-bootstrap.yml ARGS="--tags k3s_server --limit k3s_servers"

Then verify that public discovery advertises https://k8s-oidc.sgf.dev and its public JWKS URI.