Add Fraudulent Login Evaluation Enhancement Proposal

[JoseSzycho]

PR Title

docs: add enhancement proposal for fraudulent login evaluation

PR Description

Summary

This pull request adds the enhancement proposal (KEP) for shifting the responsibility of evaluating suspicious user logins and alerting users of anomalous access from the identity provider (zitadel-provider) to the central fraud detection system (fraud-operator).

Key Concepts & Proposal Details

1. Decoupling Security Policies: The authentication gateway will focus strictly on user credential validation and event propagation, delegating risk assessment to the fraud system.
2. LoginEvaluation CRD: Defines a new custom resource under fraud.miloapis.com/v1alpha1 that represents a transient login event.
   • Spec Fields: Includes userRef (referencing the user resource), loginEmail (capturing the email address used for the specific login attempt, crucial for multi-provider OIDC login contexts), and loginContext (IP address, User-Agent, device fingerprint, and creation timestamp).
   • Status & Conditions: Standardizes the evaluation results with isFraudulent and three key conditions:
     • Ready: Signifies if the evaluation completed and notification was processed.
     • UserRefValid: Indicates if the referenced user is valid and exists in the system.
     • NotificationSent: Indicates if the alert notification has been successfully created.
3. Historical Analysis: The controller queries past active user session details (retrieved from Milo Session API) to verify context safety.