Fix workload identity

[strehle]

https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation

Example for an integration of UAA into Azure/EntraID

      azure.proxy:
        type: oidc1.0
        passwordGrantEnabled: true
        discoveryUrl: https://login.microsoftonline.com/1111111-2222-3333-44444444/v2.0/.well-known/openid-configuration
        issuer: https://login.microsoftonline.com/1111111-2222-3333-44444444/v2.0
        tokenKeyUrl: https://login.microsoftonline.com/1111111-2222-3333-44444444/oauth2/v2.0/token
        scopes:
          - openid
          - email
          - profile
        linkText: Login with Azure Proxy
        relyingPartyId: 123456d6-6b10-1111-222-9b59ad09c037
        groupMappingMode: AS_SCOPES
        jwtClientAuthentication:
          iss: https://uaa.cloudfoundry.org/oauth/token
          sub: subject-for-workload-identity
        attributeMappings:
          family_name: last_name
          given_name: first_name
          email: email
          user_name: email
          external_groups:
            roles
        showLinkText: true