change: set keycloak frontend url in api for well-known discovery

[shreddedbacon]

General Checklist

• Affected Issues have been mentioned in the Closing issues section
• Documentation has been written/updated
• PR title is ready for inclusion in changelog

Database Migrations

• If your PR contains a database migation, it MUST be the latest in date order alphabetically

This change requires these changes in the charts.

The main things changing are to allow internal comms for the API to Keycloak, while still presenting the keycloak frontend url for the well-known discovery endpoint.

This still populates the forgot password reset emails with the publicly accessible Keycloak URL so that users will be able to perform password resets. This can be confirmed in both the make up and make k3d/local-stack and visiting either the mailhog/mailpit that is started and doing a password reset. In make k3d/local-stack a user is invited as part of the seeding steps, and checking in the mailpit that starts as part of that stack you'll see the reset email with the "public" URL for Keycloak.

In make k3d/local-stack there is the ability to access keycloak via https, but it will fail to load the resources because the frontend url for keycloak is set to the http endpoint in the Makefile. In production, this would be set to the https endpoint under a keycloakFrontEndURL value in the core values (but defaults to the ingress with https if not provided). This is unchanged behaviour, just calling this out here though.

[tobybellwood]

Tested working ok