feat(monitoring): support externally managed Keycloak

[Guilherme Steinmüller (guilhermesteinmuller)]

Summary

• Add kube_prometheus_stack_keycloak_manage so monitoring can use externally managed Keycloak clients.
• Allow Alertmanager, Grafana, and Prometheus client IDs and client secret names to be overridden.
• Validate pre-created Kubernetes client secrets when Keycloak management is disabled.
• Document the multi-region/shared Keycloak configuration in the main monitoring docs.

Validation

• git diff --check
• YAML parse for changed role files and release note
• GOCACHE=/tmp/go-build-cache go test ./roles/kube_prometheus_stack -run 'Test(CreateKeycloak|AddClientRoles|ValidateExternally)'

Full go test ./roles/kube_prometheus_stack is left to CI because the local run was intentionally stopped.