Per-domain directories: a refused token counts toward the sign-in ban, and tests 10 and 18 (DIR-12, DIR-30)

A token the OIDC directory rejects is an authentication failure, so it
counts toward the ban; a network, provider or configuration fault stays
an error and doesn't. Before, a rejected token was an error too, so bad
tokens never led to a ban.

The Keycloak container now imports a second realm, so test 10 checks
/api/discover and the PACC record answer with each domain's own provider.
Test 18 checks that eight sign-ins during an outage don't ban the client,
while bad tokens do.

crates/directory/src/backend/oidc/lookup.rs

@@ -33,7 +33,10 @@ impl OpenIdDirectory {
                 self.authenticate_opaque(token).await
             }
             .map_err(|err| match err {
-                OidcError::AuthorizationFailed(reason) => {
+                // inbuxa: DIR-30: a refused token is an authentication
+                // failure and counts toward the sign-in ban; a network,
+                // provider or configuration fault is an error and doesn't
+                OidcError::AuthorizationFailed(reason) | OidcError::TokenValidation(reason) => {
                     AuthEvent::Failed.into_err().reason(reason)
                 }
                 err => AuthEvent::Error.into_err().reason(err),