Add HelperWithoutCredentials for call-time-credential Keycloak login patterns

[ambersun1234-bigstack]

What type of PR is this?

/kind bug

What this PR does / why we need it

Helper.SetKeycloakClient (called internally by NewHelper) requires Options.Username+Options.Password or Options.ClientID+Options.ClientSecret to already be set, or it returns an error before ever building the underlying gocloak.Client. That's the right precondition for LoginAdmin and LoginServiceAccount, which both read those same Options fields at call time.

It's the wrong precondition for Helper.CheckLoginUser(username, password, client ClientCredentials), whose whole point is to take login credentials as call-time parameters instead of pre-configured Options. A caller that builds a Helper via NewHelper with only network-location options (scheme/ip/port/path/realm) and supplies credentials later via CheckLoginUser's own client argument could never get past NewHelper, since Options never carried any credentials in that call pattern.

This PR adds HelperWithoutCredentials as a fully independent type for that call pattern, with its own constructor (NewHelperWithoutCredentials) and its own CheckLoginUser method, rather than reusing Helper or threading a bool through SetKeycloakClient. Helper/NewHelper/SetKeycloakClient stay byte-for-byte unchanged. Because HelperWithoutCredentials has no LoginAdmin or LoginServiceAccount methods, a caller that builds one can't accidentally try to log in with Options-level credentials that were never required to construct it — that misuse is a compile error here instead of a runtime one, which a shared struct (with credential-requiring methods still attached) couldn't have prevented.

Which issue(s) this PR fixes

Fixes bigstack-oss/cubecmp#1391

Special notes for your reviewer

This is the root-cause fix for cubecmp's self-service change-password endpoint returning 500 on every call regardless of whether the submitted password was correct. cubecmp's own dependency bump + switching connection.go's CheckLoginUser wrapper to use NewHelperWithoutCredentials + end-to-end re-verification on dev-cmp will follow in a separate cubecmp PR once this is merged and released.

Additional documentation

[lizzy-liang-bigstack]

Approved to keep things moving! I haven't done a deep dive into the logic since it's outside my domain, so please make sure to get a final check from the domain expert. Just approving to unblock the pipeline for now 👍🏻