feat(garage,authentik): console multi-domain + standalone proxy outpost

Two related additions for gating a cross-host service (garage WebUI on a
storage host) behind authentik without breaking on TLS or X-Forwarded-Host:

garage role:
- Add garage_webui_domains (list), mirroring garage_s3_domains. The
  console router now accepts every entry, so a DMZ reverseproxy can use a
  backend_host whose cert SAN matches an internal *.int.* name instead of
  connecting by IP (which fails acme cert verification). Defaults to the
  single garage_webui_domain so existing inventories are unaffected.

authentik_outpost_proxy role (new):
- Standalone proxy (ForwardAuth) outpost, modelled on authentik_outpost_ldap.
  Co-locate it with the protected service so the ForwardAuth subrequest
  reaches authentik over the local docker network. The embedded outpost
  only works for services on the authentik host: a cross-host subrequest
  routed through an extra reverse-proxy hop arrives with a polluted
  X-Forwarded-Host (port/comma-appended), which the outpost no longer
  matches against the provider's external_host (404).

roles/authentik_outpost_proxy/tasks/main.yml

@@ -0,0 +1,26 @@
+#SPDX-License-Identifier: MIT-0
+---
+# tasks file for authentik_outpost_proxy
+
+- name: Create docker compose directory
+  file:
+    path: "{{ authentik_outpost_proxy_docker_compose_dir }}"
+    state: directory
+    mode: '0755'
+
+- name: Create docker-compose file for authentik proxy outpost
+  template:
+    src: docker-compose.yml.j2
+    dest: "{{ authentik_outpost_proxy_docker_compose_dir }}/docker-compose.yml"
+    mode: '0644'
+
+- name: Start authentik proxy outpost container
+  community.docker.docker_compose_v2:
+    project_src: "{{ authentik_outpost_proxy_docker_compose_dir }}"
+    state: present
+    wait: true
+    wait_timeout: 120
+  retries: 3
+  delay: 15
+  register: result
+  until: result is not failed