Add support for Keycloak deployment to ACA

[anderly]

Description

Per #6004, deploying a container provisioned via the Keycloak integration won't start in Azure Container Apps (ACA).

ACA will try to activate it, but it continuously fails.

The container reports this in the logs:

Key material not provided to setup HTTPS. Please configure your keys/certificates or start the server in development mode.

This PR includes a basic starting point for changes required to get Keycloak working in Azure Container Apps.

See my comment on #6004 showing what is necessary to get Keycloak working on ACA.

Currently, this only outputs the additional env vars if the passed port is 8443. Otherwise, it behaves as before for local dev scenarios. Open to making additional changes based on review and suggestions, but wanted to show bare minimum to get it working and be able to support ACA and SSL.

To opt-in to this configuration for deployment to ACA, users would simply specify port 8443 in the call to AddKeycloak like so:

var keycloak = builder.AddKeycloak("keycloak", 8443);

OR

var port = builder.Environment.IsDevelopment() ? 8080 : 8443;
var keycloak = builder.AddKeycloak("keycloak", port);

Another option would be an explicit Publish extension method similar to PublishAsAzurePostgresFlexibleServer on IResourceBuilder<KeycloakResource> builder for more fine-grained control over these settings.

Fixes #6004

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • [] Yes
    • Is this introducing a breaking change?
      • Yes
        • Link to aspire-docs issue (please use this breaking-change template):
      • No
        • Link to aspire-docs issue (please use this doc-idea template):
  • No

[anderly]

@dotnet-policy-service agree

[DamianEdwards]

I'm not following why this is the predicate for setting all the config to setup Keycloak for running behind a reverse proxy. My reading of this is that when the user specifies the port to be 8443, we configure the Keycloak container as if it's running behind a reverse proxy, but also enable non-HTTPS? How is it expected this will be used, i.e. what will the app host code look like?