keycloak_oidc_{vault,concourse}: add optional mapper

For cloud zone we need to add a mapper to map roles from federated realm.

This avoid to duplicate all client modules for cloud zone.