Allow user password to be auto-generated or set from secret

[nuwang]

Description

This issue is being ported over from a previously reported one here: keycloak#499, as it affects the realm operator as well. Apart from the usual issues with storing secrets in an unencrypted CR, It is particularly problematic to manage the password safely in a gitops environment.

Currently as mentioned keycloak#409 although creating a user resource leads to a secrets file being generated with the user credentials in it, we are required to explicitly set the password in the user resource.

Storing credentials in non-secrets is poor practice especially in this case, where an admin user could be created and exposed to the outside world.

Better would be either (or both)

1. Automatically generate a password if it is not provided, and store it in the secret
2. If the secret is changed externally, use that to update the user password"

Discussion

Setting

    requiredActions:
      - "UPDATE_PASSWORD"

as a means of forcing ab initial password change, also does not work as the operator continuously syncs the user CR, causing the action to be permanently required.

Motivation

Encourage good practices in storing secrets
Facilitate credential rotation

Details

references:

1. Allow user password to be auto-generated or set from secret keycloak-operator#499
2. Missing password on user credentials keycloak-operator#409
3. KeycloakUser CR - password portion is not stored in secret #6