feat(WD-36985): Jira oauth2.0 service account integration

[muhammad-ali-pk]

Problem

Previously, Jira integration relied on user accounts with basic auth (email + token).
This worked fine, but since it was dependent on user accounts, if a user's token expired or if the user account was deactivated, that resulted in integration failure.
We have now moved towards using a dedicated Jira Service Account, which follows an oauth2.0 strategy. The docs can be found here

Done

• Integrated Jira service account with oauth2.0 flow
• Updated Jira integration

QA

QA steps

• Checkout this pull request
• Get service account creds from bitwarden, named cs.canonical.com Jira service account, place them in your .env.local
• Run the project using task
• Wait for all the services to run
• Inspect web app's service logs to see there are no Jira integration failures using docker container logs cscanonicalcom-web-1
• Access the application at localhost:8104/app, and perform any Jira dependent operation to verify it works as expected (For example, try the copy update flow)

Fixes

• Fixes WD-36985

[Copilot]

Pull request overview

This PR migrates the webapp’s Jira integration from user-based basic auth (email + API token) to an OAuth 2.0 client-credentials (“service account”) flow, aligning the integration with a dedicated service account approach and updating configuration/CI accordingly.

Changes:

• Replace Jira basic-auth configuration with JIRA_CLIENT_ID / JIRA_CLIENT_SECRET.
• Update Jira client implementation to obtain and cache OAuth access tokens and route API calls via Atlassian’s api.atlassian.com/ex/jira/{cloudId} base.
• Update documentation, charm config schema, and GitHub Actions workflows to use the new Jira credentials.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
webapp/settings.py	Swaps Jira config keys from email/token to OAuth client ID/secret.
webapp/jira.py	Implements OAuth2 client-credentials token flow, cloud-id discovery, and Redis-backed token caching.
README.md	Updates local env var examples to the new Jira OAuth credentials.
charm/charmcraft.yaml	Updates charm config options to accept Jira client ID/secret.
.github/workflows/playwright.yml	Updates Playwright workflow env vars/secrets for Jira OAuth credentials (and job permissions).
.github/workflows/CI.yml	Updates CI workflow env vars for Jira OAuth credentials.
.env	Updates example env file to use Jira OAuth client ID/secret.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Onibenjo]

some comments

[Onibenjo]

LGTM. Thanks for the update

[muhammad-ali-pk]

@Onibenjo Thank you for the review, can you please take another look?

[Onibenjo]

Code +1

I'm trying to get the server up locally

[Onibenjo]

LGTM