feat(webui): download OIDC provider icons for local next/image serving

[maany]

Related to rucio/webui#805 and the WebUI-side change in rucio/webui#806.

What

For every provider listed in RUCIO_WEBUI_OIDC_PROVIDERS that declares a
RUCIO_WEBUI_OIDC_PROVIDER_<NAME>_ICON_URL, we download the icon at container
start into public/oidc-icons/<NAME>.png (upper-cased name), mirroring the
existing community-logo handling. This lets the WebUI render provider icons with
next/image instead of a plain <img> pointing at an operator-supplied remote
host that cannot be allow-listed in next.config's images.remotePatterns.

How this differs from #529

This is an alternative to #529. Instead of rewriting the *_ICON_URL value in
the generated .env to the local path (and unsetting it on failure), we only
place the file. The WebUI gateway derives the served path from the provider name
and renders the icon only when the local file exists (see rucio/webui#806), so
the container does not need to touch .env or run before env generation, and a
failed download degrades to the default icon on its own.

Details:

• Reads the RUCIO_WEBUI_-prefixed environment variables directly, the same
  source the community logo uses.
• Uses wget (installed in the image; curl is build-time only) and removes the
  destination on failure so no 0-byte file is left behind.
• Non-fatal under set -e: a bad or unreachable icon URL logs a warning and
  container startup continues.

Testing

Verified the download loop against sample env vars: a reachable icon lands at
public/oidc-icons/<NAME>.png, an unreachable one logs a warning and leaves no
file, and a provider without an icon URL is skipped, with the script exiting 0.