Fix UnknownError parsing Kerberos principal with escaped '@' - #51568

Description

KerberosPrincipal(String) split the incoming principal on every @ and required exactly two parts:

String[] parts = kerberosPrincipal.split("@");
if (parts.length != 2) {
    throw new IllegalArgumentException("Kerberos principal '" + kerberosPrincipal + "' not valid");
}

A Kerberos principal may legally contain an escaped @ (written \@) inside its name component — see RFC 1964, section 2.1.1. For such a principal, e.g. ssiemel\@a.com@KEYCLOAK.ORG, split("@") yields three parts and the constructor throws IllegalArgumentException. On the LDAP user-sync path (LDAPStorageProvider → new KerberosPrincipal(...)) this is not handled gracefully and surfaces as Could not sync users: 'UnknownError' in the admin console (with nothing in the server log), exactly as reported in the issue.

Fix

Parse the realm as the part after the single unescaped @, treating an escaped \@ inside the name as a literal (escape detection via backslash parity). Behaviour is otherwise unchanged:

All four production callers (LDAPStorageProvider, KerberosFederationProvider, SPNEGOAuthenticator, KerberosUsernamePasswordAuthenticator) route through this one constructor, so fixing the shared parser repairs every path, including the reported LDAP-sync reproducer. The change is intentionally limited to KerberosPrincipal and preserves the original exception message.

Test verification (RED → GREEN)

New unit test KerberosPrincipalTest (plain JUnit, no running server required).

RED — on unmodified main, before the production change:

[ERROR] org.keycloak.federation.kerberos.KerberosPrincipalTest.testEscapedAtInPrincipalName -- Time elapsed: 0.005 s <<< ERROR!
java.lang.IllegalArgumentException: Kerberos principal 'ssiemel\@a.com@KEYCLOAK.ORG' not valid
	at org.keycloak.federation.kerberos.KerberosPrincipal.<init>(KerberosPrincipal.java:34)
[ERROR] Tests run: 6, Failures: 0, Errors: 1, Skipped: 0

GREEN — with the fix:

[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0 -- in org.keycloak.federation.kerberos.KerberosPrincipalTest
[INFO] BUILD SUCCESS

./mvnw -pl federation/kerberos spotless:check and the module's full test suite (KerberosFederationProviderFactoryTest + KerberosPrincipalTest, 10 tests) also pass.

Note on AI usage

AI agents were used to assist with investigating and implementing this change. I understand every line of the change and can explain and revise it.

Closes #29316