Enable running acceptance tests with separate org manager users instead
of requiring full admin privileges. This includes:

Acceptance test configuration:
- Support for existing org/space/user reuse
- Skip service access management option
- Per-PR test user isolation via AUTOSCALER_TEST_USER

New scripts:
- setup-org-manager-user.sh: Create/configure org manager test users
- org-manager-login.sh: Login as org manager
- enable-service-access.sh: Enable service access as admin
- set-security-group.sh: Configure security groups for autoscaler
- register-broker.sh: Register service broker with proper permissions

CI workflow changes:
- Add cleanup, user setup, and security group steps before deployment
- Use register-broker target instead of deploy-register-cf

Acceptance test helpers:
- Org creation/management helpers
- Cleanup improvements for test isolation
- Config support for OrgManager-level permissions

Extend the CF client to support OAuth2 password grant in addition to
client_credentials. This enables authentication using org manager
user credentials for components that need CF API access.

Changes:
- cf/config.go: Add GrantType, Username, Password fields with validation
- cf/client.go: Add grant type constants
- cf/cfclient_wrapper.go: Use UserPassword config for password grant,
  switch introspect to use Basic auth directly
- cf/config_test.go: Add password grant validation tests
- cf/cfclient_wrapper_test.go: Add password grant client creation test

The gosec linter no longer flags these lines, making the
//nolint:gosec directives unnecessary. Removing them fixes
nolintlint errors in CI.

- Add #nosec G704 directives for HTTP client Do() calls in
  cfclient_wrapper.go and cf_oauth2_client.go (URLs come from
  trusted CF API endpoints or user configuration)
- Fix config deserialization test to initialize a fresh Config
  before unmarshaling, preventing state leakage from password
  grant validation tests

…mments

Use rejected-token comparison in forceRefreshToken() so that when
multiple goroutines receive 401s simultaneously, only the first one
to acquire the lock refreshes. Others see the token has changed and
reuse the new one. Remove comments that restate what the code does.

…pecs

The cf_oauth2_client_test.go used package metric (white-box) with its
own TestCFOauth2HTTPClient/RunSpecs entry point. This caused Ginkgo to
fail when running go test because TestMetricsSuite also calls RunSpecs
in the same process — Ginkgo does not support rerunning suites.

Convert to package metric_test so all specs run under the single
TestMetricsSuite runner. Replace internal field assertions with
behavioral tests that verify URL handling via actual HTTP requests.

- Add return 0 to all functions missing explicit returns
- Replace [ with [[ for safer conditional tests
- Redirect error messages to stderr with >&2
- Extract separator constant in enable-service-access.sh

Fixes 17 MAJOR shell issues flagged by SonarCloud

Conditionally use different CF users based on branch:
- Main branch: admin user (full privileges)
- PR branches: org-manager user (isolated per-PR)

Changes:
- CI: Skip org-manager setup on main branch
- Config: Detect PR_NUMBER to choose credentials
- Scripts: Introduce cf_deployment_login for context-aware auth
- Scripts: Keep cf_admin_login for truly admin-only ops

Benefits:
- Main keeps using admin (backward compatible)
- PRs use isolated users (better security, parallel testing)
- Clear separation: cf_admin_login vs cf_deployment_login

- Move GetSpaceGuid() call outside loop to avoid redundant API calls
- Enhance BoolOrInt comment explaining CF API behavior difference between admin and org-manager users

…tions

- Add is_pr_deployment()/is_main_deployment() helpers to common.sh
- Replace all inline PR_NUMBER checks with helper functions
- Make password grant conditional on PR deployments only
- Main deployments use client_credentials with autoscaler_client_id
- Add secret/client_secret fields to template for client_credentials
- Fix cf_target() comment wording per reviewer suggestion

The cleanup-autoscaler-deployments script lists all orgs containing
'autoscaler' and deletes them. This bypasses the guard in common.sh
(AUTOSCALER_ORG != DEPLOYMENT_NAME) because the script sets
DEPLOYMENT_NAME to the org name itself, making both vars equal.

Add a PROTECTED_ORGS list and filter them out of get_autoscaler_deployments()
so shared orgs are never targeted by the scheduled cleanup.

…lling

- cleanup-autoscaler-deployments.sh: replace dynamic jq filter loop with
  is_protected_org() helper and pipe filter — clearer and extensible
- run-mta-acceptance-tests.sh: query get_pr_tasks() once per poll cycle
  and pass result to both has_unfinished_tasks() and show_status(),
  halving CF API calls during monitoring

…t on setup

- mta-deploy.sh: replace set +e block with explicit error checking for
  cf curl v3/service_brokers — failures now exit with clear message
  instead of silently producing empty variable
- create-org-manager-user.sh: ensure org and space exist before targeting,
  so first-time main deployments don't fail when space is missing

- acceptance-tests-config.sh: validate AUTOSCALER_ORG_MANAGER_PASSWORD
  before use in PR mode (matches build-extension-file.sh)
- build-extension-file.sh: validate AUTOSCALER_OTHER_USER_PASSWORD for
  acceptance test credentials
- common.sh: fix stale comment about cf_target creating spaces

Script now creates org/space and test users — broader than just user
creation. Also deduplicate job-level AUTOSCALER_ORG env in reusable
workflow (already set at workflow level).

…allback

Drop the redundant existing_organization workflow input — build-extension-file.sh
already defaults EXISTING_ORGANIZATION to AUTOSCALER_ORG internally.

Also fix a latent bug where non-PR runs passed AUTOSCALER_ORG=system, overriding
the vars.source.sh default of DEPLOYMENT_NAME. Now passes empty string so the
script default takes effect correctly.

…ceptance-tests

…dpoint

…STING_ORG

- Add INFRASTRUCTURE var (default OSS) to vars.source.sh
- Add is_oss_infrastructure() predicate to common.sh
- Extract create-acceptance-space.sh (runs before provision-db)
- Add provision-db-service.sh for non-OSS: cf create-service using
  POSTGRES_SERVICE_OFFERING/PLAN vars instead of bosh/credhub
- build-extension-file.sh: skip bbl_login and credhub on non-OSS;
  patch database resource to org.cloudfoundry.existing-service post-envsubst
- acceptance_tests_reusable.yaml: add infrastructure/postgres inputs,
  conditional provision-db vs provision-db-service steps

The create-acceptance-space step was missing AUTOSCALER_ORG_MANAGER_USER
and AUTOSCALER_ORG_MANAGER_PASSWORD env vars. The cf_deployment_login()
function in common.sh requires both for non-main (PR) deployments, causing
the deploy job to fail with "ERROR: AUTOSCALER_ORG_MANAGER_PASSWORD is not set".

- cleanup-autoscaler.sh: skip bbl_login/credhub/deprovision_db on non-OSS;
  use cf_deployment_login; delete CF service instance instead
- acceptance_tests_reusable.yaml: pass INFRASTRUCTURE + CF credentials
  to the cleanup step