authentik: log in to immich with Scouts Online

Adds Scouts Online 3 (login.scouting.nl) as an OIDC source. Its userinfo
has the member's roles within the group; a property mapping puts every
member in "MBG leden" and those with an active Kaderlid role also in
"MBG kader", on every login. Members become external users. Family
members can share an email address and immich needs a unique one, so
those get a plus address with their member number.

The immich provider now authenticates through a flow whose only stage
is an identification stage with this one source and no fields, which
sends people straight on to Scouts Online. The source's own flows only
run through the source.

apps/templates/authentik-helm.yaml

@@ -142,6 +142,14 @@ spec:
                         items:
                           - key: client_secret
                             path: immich-oidc-client-secret
+                    - secret:
+                        name: scouts-online-client
+                        optional: true
+                        items:
+                          - key: client_id
+                            path: scouts-online-client-id
+                          - key: client_secret
+                            path: scouts-online-client-secret
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -219,6 +227,14 @@ spec:
                         items:
                           - key: client_secret
                             path: immich-oidc-client-secret
+                    - secret:
+                        name: scouts-online-client
+                        optional: true
+                        items:
+                          - key: client_id
+                            path: scouts-online-client-id
+                          - key: client_secret
+                            path: scouts-online-client-secret
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml