Let ExecuteActionsEmail set a custom action-token lifespan

[ambersun1234]

What type of PR is this?

/kind feature

What this PR does / why we need it

Helper.ExecuteActionsEmail never set gocloak.ExecuteActionsEmail's Lifespan field, so every caller got Keycloak's own 12-hour default for admin-triggered action tokens — far longer than intended for something like a password-reset link, and inconsistent with the much shorter lifespan Keycloak's self-service action-token flow already defaults to.

Adds a lifespanSeconds parameter, threaded into gocloak's Lifespan field (already supported server-side, just never set by this wrapper) — but only when it's genuinely positive. gocloak.ExecuteActionsEmail.Lifespan is *int with omitempty, which only checks pointer-nilness, not the pointee's value — a naive &lifespanSeconds would send a literal lifespan=0 for a zero/uninitialized argument, minting an already-expired action token with no error surfaced anywhere in the call chain. Guarding on lifespanSeconds > 0 instead leaves the field unset (nil) for that case, falling back to Keycloak's own realm default — the same behavior this method had before Lifespan existed at all.

This is a breaking signature change to an exported method (ExecuteActionsEmail(realm, userID string, actions []string) error → ExecuteActionsEmail(realm, userID string, actions []string, lifespanSeconds int) error). The one current caller (cubecmp's admin-triggered reset-password routes) is updated in a companion PR, pinned to this branch's commit — see cubecmp issue #1086.

Which issue(s) this PR fixes

Refs bigstack-oss/cubecmp#1086

Special notes for your reviewer

Went through one round of /code-review --level xhigh before opening this — it caught the zero-lifespan omitempty footgun above (fixed) and a style inconsistency using gocloak.IntP(...) instead of a raw &lifespanSeconds for the pointer conversion (also fixed, now consistent with the rest of this file).

Additional documentation