The CAO and KAS-o both need to work and enable structured authentication configuration for the KAS static pods.

CAO:

• a controller tracks the auth CR for auth type OIDC
• generates structured auth config object and serializes it into a configmap
• syncs the configmap into openshift-config

KAS-o:

• a config observer tracks the auth CR for type OIDC
• syncs the auth configmap from openshift-config into openshift-kube-apiserver and enables the `--authentication-config` CLI arg for the KAS pods
• the auth-metadata and webhook-authenticator config observers remove their resources and CLI args accordingly
• a revision controller syncs that configmap into a static file