Add identity and target authorization package

OIDC validation, principal mapping, remora:v1 roles, and current-authz
filtering with kind acceptance on Keycloak and ZITADEL.

crates/remora-identity/migrations/0001_principals.sql

@@ -0,0 +1,10 @@
+-- Stable principal mapping from OIDC issuer+subject pairs.
+-- Feature package remora-identity owns this schema.
+
+CREATE TABLE principal_identities (
+    principal_id TEXT PRIMARY KEY,
+    issuer TEXT NOT NULL,
+    subject TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (issuer, subject)
+);