Description

Adds opt-in --oidc-lazy-discovery (default false). When the OIDC issuer is
unreachable at startup, oauth2-proxy starts anyway with a not-ready provider and
performs OIDC discovery in the background (retrying with exponential
backoff), swapping in the real provider once the issuer is reachable — no
restart needed.

While discovery is pending, provider-independent features keep working (Basic
Auth via --htpasswd-file, health checks, static upstreams). The readiness
endpoint stays healthy so the pod remains in load-balancer rotation; the
/oauth2/start login flow returns 503 until discovery succeeds.

The background backoff is configurable via --oidc-lazy-discovery-initial-interval
(default 3s) and --oidc-lazy-discovery-max-interval (default 30s).

With the flag unset (default), behaviour is unchanged: a single discovery
attempt at startup, failing fast on error.

Motivation and Context

A single failed OIDC discovery call currently aborts startup, so oauth2-proxy
can't come up if the identity provider is briefly unavailable (e.g. both
starting together in Kubernetes) — even when Basic Auth is configured as a
fallback. This makes discovery resilient without changing the default.

Fixes #3487

How Has This Been Tested?

• providers/lazy_provider_test.go: not-ready gating (OAuth methods return
  ErrProviderNotReady, Data() serves a placeholder), becomes-ready against a
  mock issuer, and background-loop cancellation via context.
• oauthproxy_lazy_test.go: lazy fallback vs. fail-fast in setupProvider,
  /ready returning 200 while discovery is pending, and /oauth2/start
  returning 503 while not ready.
• Manually verified against a Keycloak setup (issue reporter): starts with an
  unreachable/404 issuer and unresolvable DNS; Basic Auth keeps working and the
  provider becomes ready once the issuer is reachable.
• golangci-lint (v2.11.4): 0 issues; go test -race ./... passes;
  alpha_config.md regenerated via make generate.

Checklist:

• I have added an entry for my changes to the CHANGELOG.md.
• I have signed off all my commits.
• I have created a feature (non-master) branch for my PR.
• I have used conventional commits for the PR title.
• I have written tests for my code changes.