Per-domain directories: a refused token counts toward the sign-in ban, and tests 10 and 18 (DIR-12, DIR-30)

A token the OIDC directory rejects is an authentication failure, so it
counts toward the ban; a network, provider or configuration fault stays
an error and doesn't. Before, a rejected token was an error too, so bad
tokens never led to a ban.

The Keycloak container now imports a second realm, so test 10 checks
/api/discover and the PACC record answer with each domain's own provider.
Test 18 checks that eight sign-ins during an outage don't ban the client,
while bad tokens do.

tests/docker/keycloak/inbuxa-realm.json

@@ -0,0 +1,207 @@
+{
+ "realm": "inbuxa",
+ "enabled": true,
+ "registrationAllowed": false,
+ "loginWithEmailAllowed": true,
+ "duplicateEmailsAllowed": false,
+ "sslRequired": "none",
+ "clients": [
+  {
+   "clientId": "stalwart",
+   "enabled": true,
+   "clientAuthenticatorType": "client-secret",
+   "secret": "stalwart-secret",
+   "redirectUris": [
+    "*"
+   ],
+   "webOrigins": [
+    "*"
+   ],
+   "publicClient": false,
+   "protocol": "openid-connect",
+   "directAccessGrantsEnabled": true,
+   "standardFlowEnabled": true,
+   "serviceAccountsEnabled": true,
+   "defaultClientScopes": [
+    "openid",
+    "email",
+    "profile",
+    "roles"
+   ],
+   "protocolMappers": [
+    {
+     "name": "groups",
+     "protocol": "openid-connect",
+     "protocolMapper": "oidc-group-membership-mapper",
+     "consentRequired": false,
+     "config": {
+      "full.path": "false",
+      "id.token.claim": "true",
+      "access.token.claim": "true",
+      "claim.name": "groups",
+      "userinfo.token.claim": "true"
+     }
+    },
+    {
+     "name": "email-claim",
+     "protocol": "openid-connect",
+     "protocolMapper": "oidc-usermodel-attribute-mapper",
+     "consentRequired": false,
+     "config": {
+      "user.attribute": "email",
+      "id.token.claim": "true",
+      "access.token.claim": "true",
+      "claim.name": "email",
+      "userinfo.token.claim": "true",
+      "jsonType.label": "String"
+     }
+    },
+    {
+     "name": "audience",
+     "protocol": "openid-connect",
+     "protocolMapper": "oidc-audience-mapper",
+     "consentRequired": false,
+     "config": {
+      "included.client.audience": "stalwart",
+      "id.token.claim": "false",
+      "access.token.claim": "true"
+     }
+    }
+   ]
+  },
+  {
+   "clientId": "stalwart-fallback",
+   "enabled": true,
+   "clientAuthenticatorType": "client-secret",
+   "secret": "stalwart-fallback-secret",
+   "redirectUris": [
+    "*"
+   ],
+   "webOrigins": [
+    "*"
+   ],
+   "publicClient": false,
+   "protocol": "openid-connect",
+   "directAccessGrantsEnabled": true,
+   "standardFlowEnabled": true,
+   "serviceAccountsEnabled": true,
+   "defaultClientScopes": [
+    "openid"
+   ],
+   "optionalClientScopes": [
+    "email",
+    "profile",
+    "roles"
+   ],
+   "protocolMappers": [
+    {
+     "name": "email-claim-userinfo-only",
+     "protocol": "openid-connect",
+     "protocolMapper": "oidc-usermodel-attribute-mapper",
+     "consentRequired": false,
+     "config": {
+      "user.attribute": "email",
+      "id.token.claim": "false",
+      "access.token.claim": "false",
+      "claim.name": "email",
+      "userinfo.token.claim": "true",
+      "jsonType.label": "String"
+     }
+    },
+    {
+     "name": "groups-userinfo-only",
+     "protocol": "openid-connect",
+     "protocolMapper": "oidc-group-membership-mapper",
+     "consentRequired": false,
+     "config": {
+      "full.path": "false",
+      "id.token.claim": "false",
+      "access.token.claim": "false",
+      "claim.name": "groups",
+      "userinfo.token.claim": "true"
+     }
+    },
+    {
+     "name": "audience",
+     "protocol": "openid-connect",
+     "protocolMapper": "oidc-audience-mapper",
+     "consentRequired": false,
+     "config": {
+      "included.client.audience": "stalwart",
+      "id.token.claim": "false",
+      "access.token.claim": "true"
+     }
+    }
+   ]
+  }
+ ],
+ "users": [
+  {
+   "username": "[email protected]",
+   "enabled": true,
+   "email": "[email protected]",
+   "emailVerified": true,
+   "firstName": "John",
+   "lastName": "Doe",
+   "credentials": [
+    {
+     "type": "password",
+     "value": "this is an OIDC password",
+     "temporary": false
+    }
+   ],
+   "groups": [
+    "/[email protected]"
+   ]
+  },
+  {
+   "username": "[email protected]",
+   "enabled": true,
+   "email": "[email protected]",
+   "emailVerified": true,
+   "firstName": "Jane",
+   "lastName": "Smith",
+   "credentials": [
+    {
+     "type": "password",
+     "value": "this is an OIDC password",
+     "temporary": false
+    }
+   ],
+   "groups": [
+    "/[email protected]",
+    "/[email protected]"
+   ]
+  },
+  {
+   "username": "[email protected]",
+   "enabled": true,
+   "email": "[email protected]",
+   "emailVerified": true,
+   "firstName": "Bill",
+   "lastName": "Foobar",
+   "credentials": [
+    {
+     "type": "password",
+     "value": "this is an OIDC password",
+     "temporary": false
+    }
+   ],
+   "groups": [
+    "/[email protected]"
+   ]
+  }
+ ],
+ "groups": [
+  {
+   "name": "[email protected]",
+   "path": "/[email protected]"
+  },
+  {
+   "name": "[email protected]",
+   "path": "/[email protected]"
+  }
+ ],
+ "id": "inbuxa",
+ "displayName": "inbuxa test realm"
+}