feat: add multi-role onboarding configuration

[ojarosch]

• Add keyed roles and subjects root configuration for multi-role onboarding.
• Assign multiple roles to local users, SSO users, and SSO groups in one resource.
• Add scoped role permissions for workflow groups, cloud connectors, VCS connectors, and templates.
• Add commented HCL onboarding examples for local users, SSO users, and SSO groups.
• Discover and run OpenTofu tests from all tests/*.tofutest.hcl locations.

[joscheuerer]

all good