frontegg-auth: resolve the group claim path against all JWT claims - #38410

Motivation

oidc_group_claim selects which JWT claim group-to-role sync reads group names from. On the Frontegg authenticator, that lookup ran against Claims::unknown_claims, the #[serde(flatten)] catch-all:

pub fn groups(&self, claim_path: &str) -> Option<Vec<String>> {
    mz_auth::group_claims::extract_groups(&self.unknown_claims, claim_path)
}

Serde's flatten collects only the keys that no named field claimed. Claims declares ten named fields, so sub, exp, iss, type, email, userId, tenantId, roles, permissions, and metadata never appear in that map and could not be selected as the group claim at all, however oidc_group_claim was set.

roles is the claim an operator is most likely to reach for. Frontegg emits it natively and populates it from group-to-role mappings, so mapping IdP groups to Frontegg roles and syncing those role names is the obvious configuration, and it needs no custom claim, no JWT prehook, and no group cache. Today that setting is accepted and then silently finds nothing: extraction returns None, which maybe_sync_jwt_groups treats as "claim absent, skip sync". That branch logs nothing and sends no client notice, so there is no signal anywhere that the configured claim is unreachable.

The OIDC authenticator does not have this problem. OidcClaims types only iss, exp, iat, and aud, so every other claim lands in its flatten map and resolves normally, roles included. The same oidc_group_claim value therefore selected different claims depending on the authenticator, which defeats the purpose of routing both through the shared mz_auth::group_claims extractor.

Change

Resolve the claim path against a JSON view of the whole Claims struct rather than the flatten map alone. Claims already derives Serialize with rename_all = "camelCase", so the reconstructed keys match the wire format.

The typed fields are left in place, is_admin reads roles directly. Nested untyped paths such as customClaims.groups keep resolving exactly as before. roles becomes reachable generically, with no special case for it.

Tests

Adds groups_from_typed_roles_claim to the frontegg-auth unit tests, covering selection of a claim backed by a typed field. The existing groups_absent_returns_none, groups_empty_returns_some_empty, and groups_populated_returns_some_values cases continue to cover the untyped paths.

Release notes

This release will allow oidc_group_claim to select any claim present in the JWT when using Frontegg authentication, including roles. Previously, claims that Materialize parses into typed fields, such as roles and permissions, could not be used as the group claim, and configuring one caused group-to-role sync to be skipped without any error or notice.