refactor(authbridge): collapse authbridge-lite into a build-tag variant of authbridge-proxy

[huang195]

Problem

authbridge-lite is a separate cmd/ binary that differs from authbridge-proxy in only one dimension: its compiled-in plugin set. Same HTTP listeners (forward/reverse proxy), same pure-Go CGO_ENABLED=0 build, same Alpine base.

This duplication has already drifted:

• Lite's main.go header claimed "jwt-validation + token-exchange as the only plugins" and "drops the gRPC/envoy dependency tree" — but it actually imported opa + tokenbroker (and the proxy build was never an envoy build either).
• The opa import drags in the full OPA/Rego Go SDK (github.com/open-policy-agent/opa v1.4.2), which negated lite's stated size goal: measured, the authbridge-lite image (43.6 MB) was essentially the same size as authbridge-proxy (43.7 MB) — dropping 5 plugins saved only ~0.1 MB because the OPA SDK (the dominant weight) stayed in.

Solution

The repo already has the right mechanism — a per-plugin Go build tag (//go:build !exclude_plugin_ibac in cmd/authbridge-proxy/plugins_ibac.go) — and the proxy Dockerfile already accepts ARG GO_BUILD_TAGS. So:

1. Generalize the exclude_plugin_* pattern to every plugin in cmd/authbridge-proxy (one plugins_<name>.go per plugin, gated by //go:build !exclude_plugin_<name>). jwt-validation and token-exchange stay always-compiled.
2. Delete cmd/authbridge-lite/.
3. Build the authbridge-lite image from the proxy Dockerfile with the exclude tags (image name preserved for consumers) — it becomes a build variant, not a separate binary.
4. Update CI (build.yaml/ci.yaml), go.work, dependabot, Makefile, local-build-and-test.sh, and the docs.

Result (measured)

• Lite binary: 14.7 MB vs full proxy 27.8 MB (~47% smaller); 0 open-policy-agent symbols (the full binary has 7,475).
• Lite image (built via the proxy Dockerfile + GO_BUILD_TAGS): 29.7 MB vs full 43.7 MB.
• go build / go vet / go test pass both with and without the lite tags; a PR-time CI check compiles the lite tag set.

Notes

• The lite image now runs the authbridge-proxy binary (logs as authbridge-proxy). abctl is unaffected (keys on container name). Operator/observability configs keying on the authbridge-lite process/log name should be checked.
• Out of scope: generalizing the tags to cmd/authbridge-envoy (no consumer; trivial follow-up); build-tagging tlsbridge/SPIFFE out of main.go.

Part of rossoctl/rossoctl#1458.