fix: progagation of service accounts for site replication (#14054)

- Only non-root-owned service accounts are replicated for now.
- Add integration tests for OIDC with site replication

.github/workflows/iam-integrations.yaml

@@ -88,4 +88,8 @@ jobs:
       - name: Test LDAP for automatic site replication
         if: matrix.ldap == 'localhost:389'
         run: |
-          make test-site-replication
+          make test-site-replication-ldap
+      - name: Test OIDC for automatic site replication
+        if: matrix.openid == 'http://127.0.0.1:5556/dex'
+        run: |
+          make test-site-replication-oidc