feat(operator): Provision minimal TokenReview RBAC for OIDC auth

When authz: oidc is configured, the operator now provisions a dedicated
feast-oidc-token-review ClusterRole and per-instance ClusterRoleBinding
with tokenreviews/create permission for SA token delegation.
Changes:
- Add OIDC status condition (AuthorizationReadyType) for feature parity
  with Kubernetes auth
- Use instance-independent labels for shared ClusterRole to avoid
  misleading audit trails when multiple FeatureStores use OIDC
- Clean up Kubernetes ClusterRoleBinding when switching auth types
- Add test coverage for OIDC RBAC creation and cleanup

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Author: aniketpalu

.secrets.baseline

@@ -934,7 +934,7 @@
         "filename": "infra/feast-operator/api/v1/featurestore_types.go",
         "hashed_secret": "44e17306b837162269a410204daaa5ecee4ec22c",
         "is_verified": false,
-        "line_number": 761
+        "line_number": 763
       }
     ],
     "infra/feast-operator/api/v1/zz_generated.deepcopy.go": [
@@ -1122,7 +1122,7 @@
         "filename": "infra/feast-operator/internal/controller/featurestore_controller_oidc_auth_test.go",
         "hashed_secret": "a1f14fc6f33ba39a8b6d006fefa6fe0fe8d60ae2",
         "is_verified": false,
-        "line_number": 447
+        "line_number": 450
       }
     ],
     "infra/feast-operator/internal/controller/featurestore_controller_test_utils_test.go": [
@@ -1539,5 +1539,5 @@
       }
     ]
   },
-  "generated_at": "2026-04-09T03:30:18Z"
+  "generated_at": "2026-04-22T15:02:50Z"
 }

infra/feast-operator/api/v1/featurestore_types.go

@@ -52,6 +52,7 @@ const (
 	ClientFailedReason           = "ClientDeploymentFailed"
 	CronJobFailedReason          = "CronJobDeploymentFailed"
 	KubernetesAuthzFailedReason  = "KubernetesAuthorizationDeploymentFailed"
+	OidcAuthzFailedReason        = "OidcAuthorizationDeploymentFailed"
 
 	// Feast condition messages:
 	ReadyMessage                  = "FeatureStore installation complete"
@@ -62,6 +63,7 @@ const (
 	ClientReadyMessage            = "Client installation complete"
 	CronJobReadyMessage           = "CronJob installation complete"
 	KubernetesAuthzReadyMessage   = "Kubernetes authorization installation complete"
+	OidcAuthzReadyMessage         = "OIDC authorization installation complete"
 	DeploymentNotAvailableMessage = "Deployment is not available"
 
 	// entity_key_serialization_version

infra/feast-operator/bundle/manifests/feast-operator.clusterserviceversion.yaml

@@ -50,7 +50,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2026-04-08T14:26:31Z"
+    createdAt: "2026-04-21T14:06:03Z"
     operators.operatorframework.io/builder: operator-sdk-v1.38.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: feast-operator.v0.62.0
@@ -79,9 +79,12 @@ spec:
       clusterPermissions:
       - rules:
         - apiGroups:
-          - apps
+          - ""
           resources:
-          - deployments
+          - configmaps
+          - persistentvolumeclaims
+          - serviceaccounts
+          - services
           verbs:
           - create
           - delete
@@ -90,65 +93,62 @@ spec:
           - update
           - watch
         - apiGroups:
-          - authentication.k8s.io
+          - ""
           resources:
-          - tokenreviews
+          - namespaces
+          - pods
+          - secrets
+          verbs:
+          - get
+          - list
+          - watch
+        - apiGroups:
+          - ""
+          resources:
+          - pods/exec
           verbs:
           - create
         - apiGroups:
-          - autoscaling
+          - apps
           resources:
-          - horizontalpodautoscalers
+          - deployments
           verbs:
           - create
           - delete
           - get
           - list
-          - patch
           - update
           - watch
         - apiGroups:
-          - batch
+          - authentication.k8s.io
           resources:
-          - cronjobs
+          - tokenreviews
           verbs:
           - create
-          - delete
-          - get
-          - list
-          - patch
-          - update
-          - watch
         - apiGroups:
-          - ""
+          - autoscaling
           resources:
-          - configmaps
-          - persistentvolumeclaims
-          - serviceaccounts
-          - services
+          - horizontalpodautoscalers
           verbs:
           - create
           - delete
           - get
           - list
+          - patch
           - update
           - watch
         - apiGroups:
-          - ""
+          - batch
           resources:
-          - namespaces
-          - pods
-          - secrets
+          - cronjobs
           verbs:
+          - create
+          - delete
           - get
           - list
+          - patch
+          - update
           - watch
-        - apiGroups:
-          - ""
-          resources:
-          - pods/exec
-          verbs:
-          - create
         - apiGroups:
           - feast.dev
           resources: