fix: Respect the next link in UIF Entra backend requests (#859)

* fix: respect next link in uif entra backend requests

* fix: bound Entra group pagination, keep all memberships, add HTTP timeouts

Follow-ups to the @odata.nextLink pagination fix in #859:

- Add a 60s request / 15s connect timeout to every user-info-fetcher
  outbound HTTP backend (Keycloak, Entra, XFSC AAS) via a shared
  utils::http::client_builder(); reqwest otherwise waits indefinitely.
- Keep every directory membership by requesting /memberOf instead of
  restricting to microsoft.graph.group, so directory roles and
  administrative units are still returned.
- Cap @odata.nextLink following at 100 pages as a backstop against a
  cyclic or runaway link, warning if the group list may be truncated.
- Bump the yanked spin 0.9.8 to 0.9.9 (matching #857, which only landed
  on release-26.7) so cargo-deny passes, and regenerate Cargo.nix for
  the new wiremock dev-dependency.

* fix: address review feedback

- Restructure the Entra group pagination loop guard-first: check the page
  cap and warn/break before doing the request, per review.
- Reword the changelog entry for the pagination fix.

---------

Co-authored-by: Lars Francke <jujutsu@lars-francke.de>

Author: 2 people

CHANGELOG.md

@@ -22,6 +22,14 @@ All notable changes to this project will be documented in this file.
 - BREAKING: Removed product-config machinery. This is a breaking change in terms of configuration.
   Users relying on the product-config `properties.yaml` file have to set these properties via the CRD.
   JsonPatches has been renamed to JsonPatch ([#842]).
+- Apply a 60s request and 15s connect timeout to all user-info-fetcher outbound HTTP backends
+  (Keycloak, Entra, XFSC AAS), which previously waited indefinitely ([#859]).
+
+### Fixed
+
+- The user-info-fetcher Entra backend now follows Microsoft Graph's `@odata.nextLink` pagination
+  links - up to 100 times - to fetch 999 group memberships per result page, resulting in a maximum
+  of 99900 fetched memberships for a single user ([#859]).
 
 ### Removed
 
@@ -38,6 +46,7 @@ All notable changes to this project will be documented in this file.
 [#842]: https://github.com/stackabletech/opa-operator/pull/842
 [#843]: https://github.com/stackabletech/opa-operator/pull/843
 [#851]: https://github.com/stackabletech/opa-operator/pull/851
+[#859]: https://github.com/stackabletech/opa-operator/pull/859
 
 ## [26.3.0] - 2026-03-16
 

Cargo.lock

@@ -48,6 +48,7 @@ tokio = { version = "1.52", features = ["full"] }
 tracing = "0.1"
 url = "2.5"
 uuid = "1.10"
+wiremock = "0.6"
 
 [patch."https://github.com/stackabletech/operator-rs.git"]
 # stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }