fix: bound Entra group pagination, keep all memberships, add HTTP timeouts

Follow-ups to the @odata.nextLink pagination fix in #859:

- Add a 60s request / 15s connect timeout to every user-info-fetcher
  outbound HTTP backend (Keycloak, Entra, XFSC AAS) via a shared
  utils::http::client_builder(); reqwest otherwise waits indefinitely.
- Keep every directory membership by requesting /memberOf instead of
  restricting to microsoft.graph.group, so directory roles and
  administrative units are still returned.
- Cap @odata.nextLink following at 100 pages as a backstop against a
  cyclic or runaway link, warning if the group list may be truncated.
- Bump the yanked spin 0.9.8 to 0.9.9 (matching #857, which only landed
  on release-26.7) so cargo-deny passes, and regenerate Cargo.nix for
  the new wiremock dev-dependency.

Author: lfrancke

CHANGELOG.md

@@ -22,6 +22,14 @@ All notable changes to this project will be documented in this file.
 - BREAKING: Removed product-config machinery. This is a breaking change in terms of configuration.
   Users relying on the product-config `properties.yaml` file have to set these properties via the CRD.
   JsonPatches has been renamed to JsonPatch ([#842]).
+- Apply a 60s request and 15s connect timeout to all user-info-fetcher outbound HTTP backends
+  (Keycloak, Entra, XFSC AAS), which previously waited indefinitely ([#859]).
+
+### Fixed
+
+- The Entra user-info-fetcher backend now follows Microsoft Graph's `@odata.nextLink` pagination,
+  so users with more group memberships than fit on a single response page receive their complete
+  group list. Following the link is bounded to 100 pages as a safeguard ([#859]).
 
 ### Removed
 
@@ -38,6 +46,7 @@ All notable changes to this project will be documented in this file.
 [#842]: https://github.com/stackabletech/opa-operator/pull/842
 [#843]: https://github.com/stackabletech/opa-operator/pull/843
 [#851]: https://github.com/stackabletech/opa-operator/pull/851
+[#859]: https://github.com/stackabletech/opa-operator/pull/859
 
 ## [26.3.0] - 2026-03-16