feat: add conditional authenticator that matches org and client attributes at runtime

[tchoumi313]

Summary

This PR adds a new conditional authenticator that compares a user organization attribute against a client attribute value resolved at login time.

It is intended for multi-tenant setups where each OIDC client carries a tenant marker such as tenant_id, and authentication should continue only when the user belongs to a matching organization.

What is added

• ConditionalOrgAttributeMatchesClientAttribute
• ConditionalOrgAttributeMatchesClientAttributeFactory
• Provider ID: conditional-org-client-attr

Behavior

Config properties:

• org_attribute_name (String): organization attribute key to check, for example tenant_id
• client_attribute_name (String): client attribute key containing the expected value
• negate_output (Boolean): invert the result

Evaluation flow:

1. Read the current client attribute value using client_attribute_name
2. Enumerate the user’s organization memberships
3. Return a match if any organization has org_attribute_name == clientAttributeValue
4. Apply negate_output when configured

Why this is needed

The existing ConditionalOrgAttributeValue provider compares an organization attribute against a static value configured in the authenticator.

This new provider allows the expected value to come from the current client at runtime, so one shared flow can work across many tenant-specific clients without duplicating flows per tenant.

Security model

The provider is fail-closed by design.

Missing config, missing client attribute, missing OrganizationProvider, or empty memberships evaluate to no-match.

Validation

• Maven package build passed
• The built jar contains the new authenticator classes
• The factory is registered for discovery and the provider is visible at runtime as conditional-org-client-attr

Notes

• This PR adds a new provider alongside the existing ConditionalOrgAttributeValue; it does not modify the behavior of the existing provider.
• Implementation follows the existing condition/factory pattern in this module and keeps scope limited to a new condition.