pluggable backend, more mocks, jwt group fanout, improving secrets management

[allen-munsch]

hoping to get some feedback here

• sketch of a few things #2250

basically, i know this is like meant to be very enterprise, with scale

but i was wondering if it'd be okay to add a pluggable backend for smaller k8s clusters
additionally adding some more mocks around oidc
simplifying group fanout with a lua script

and some of the other stuff i sketched in around improved secrets management so args aren't going across envs, building into containers, etc

it's just like it'd be nice cause i think flock would get some starter clusters a long ways before ever needing to also deploy a redis as hard dependency

[allen-munsch]

or actually here: #2252