Filter stale role IDs in Infinispan client adapters - #51616

This is a good, minimal fix and it matches the JPA adapters exactly — I (Claude code) traced the NPE through RealmCacheSession.getRoleById() returning null for an unresolvable role, into RoleUtils.expandCompositeRoles()'s ArrayDeque, which confirms the root cause described in #51589.

One thing I'd like to see before merge: a regression test. model/infinispan doesn't have existing unit tests for ClientAdapter/ClientScopeAdapter, so this bug shipped without anything catching it, and a compile-only check won't stop it from regressing again. The good news is ClientAdapter and ClientScopeAdapter are easy to instantiate directly with mocked collaborators — no need for a full DB/cache integration test. Something like:

package org.keycloak.models.cache.infinispan;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import java.util.List;
import java.util.Set;

import org.junit.jupiter.api.Test;
import org.keycloak.models.RealmModel;
import org.keycloak.models.RoleModel;
import org.keycloak.models.cache.infinispan.entities.CachedClient;

class ClientAdapterTest {

    @Test
    void getScopeMappingsStreamFiltersUnresolvableRoleIds() {
        RealmModel realm = mock(RealmModel.class);
        RealmCacheSession cacheSession = mock(RealmCacheSession.class);
        CachedClient cached = mock(CachedClient.class);

        RoleModel liveRole = mock(RoleModel.class);
        when(cached.getScope()).thenReturn(Set.of("stale-role-id", "live-role-id"));
        // simulates a role deleted on another node whose cache invalidation
        // hasn't reached this one yet
        when(cacheSession.getRoleById(eq(realm), eq("stale-role-id"))).thenReturn(null);
        when(cacheSession.getRoleById(eq(realm), eq("live-role-id"))).thenReturn(liveRole);

        ClientAdapter adapter = new ClientAdapter(realm, cached, cacheSession);

        List<RoleModel> result = adapter.getScopeMappingsStream().toList();

        assertEquals(List.of(liveRole), result,
                "a scope mapping pointing at an unresolvable role must be silently dropped, not surfaced as null");
    }
}

The equivalent test for ClientScopeAdapter follows the same shape — swap CachedClient for CachedClientScope and the constructor args (ClientScopeAdapter(RealmModel, CachedClientScope, RealmCacheSession) — check the actual signature).

Two things worth double-checking when you write it:

• ClientAdapter.isUpdated() short-circuits to false as long as invalidated is false and updated == null (both true by default on a fresh instance), so you shouldn't need to stub cacheSession.getClientDelegate() — but verify that against the constructor you're using in case defaults differ.
• Assert on the filtered set only — don't assert cacheSession.getRoleById() was called exactly twice, since that couples the test to iteration order/count rather than the behavior you actually care about (nulls don't leak into the stream).