feat: handle Zitadel provider IdP login via login v1 (#12469)

# Which Problems Are Solved

This PR adds support for using a ZITADEL IdP provider in the login v1 UI
flow and conditionally grants a support-user instance membership based
on a ZITADEL-specific project-roles token claim.

# How the Problems Are Solved

- Introduced ZITADEL IdP handling in the login v1 handler, including
extracting the `urn:zitadel:iam:org:project:roles` claim and granting
`IAM_OWNER_VIEWER` instance membership when configured orgs match.
- Added a new `AddInstanceMemberFromLogin` to assign an instance
membership during the login v1 ZITADEL-IdP flow without permission
checks (as the authorization is established based on the project roles
in the token claim)
- Added unit tests

# Additional Changes

N/A

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/12446

internal/domain/auth_request.go

@@ -104,6 +104,11 @@ type ExternalUser struct {
 	Phone             PhoneNumber
 	IsPhoneVerified   bool
 	Metadatas         []*Metadata
+	// ProjectRoles holds the ZITADEL `urn:zitadel:iam:org:project:roles` claim
+	// ({role: {orgID: orgDomain}}) as returned by a ZITADEL provider. It is
+	// captured at authentication and carried through to user creation, where it
+	// is used to grant the support-user instance membership.
+	ProjectRoles map[string]map[string]string
 }
 
 type Prompt int32

internal/domain/roles.go

@@ -14,6 +14,7 @@ const (
 	RoleOrgOwner             = "ORG_OWNER"
 	RoleOrgProjectCreator    = "ORG_PROJECT_CREATOR"
 	RoleIAMOwner             = "IAM_OWNER"
+	RoleIAMOwnerViewer       = "IAM_OWNER_VIEWER"
 	RoleIAMLoginClient       = "IAM_LOGIN_CLIENT"
 	RoleProjectOwner         = "PROJECT_OWNER"
 	RoleProjectOwnerGlobal   = "PROJECT_OWNER_GLOBAL"