need Kustomization.spec.healthChecks for Keycloak OIDC clients

We have many units producing Keycloak OIDC clients (clients.openidclient.keycloak.m.crossplane.io resources), but these resources can't be correctly checked for readiness by flux because they are not kstatus compliant.

$ k get clients.openidclient.keycloak.m.crossplane.io -n keycloak harbor -o yaml | yq .status
atProvider:
  accessTokenLifespan: ""
  accessType: CONFIDENTIAL
  adminUrl: ""
  allowRefreshTokenInStandardTokenExchange: ""
  alwaysDisplayInConsole: false
  backchannelLogoutRevokeOfflineSessions: false
  backchannelLogoutSessionRequired: true
  backchannelLogoutUrl: ""
  baseUrl: ""
  clientAuthenticatorType: client-secret
  clientId: harbor
  clientOfflineSessionIdleTimeout: ""
  clientOfflineSessionMaxLifespan: ""
  clientSessionIdleTimeout: ""
  clientSessionMaxLifespan: ""
  consentRequired: false
  consentScreenText: ""
  description: ""
  directAccessGrantsEnabled: true
  displayOnConsentScreen: false
  enabled: true
  frontchannelLogoutEnabled: false
  frontchannelLogoutUrl: ""
  fullScopeAllowed: true
  id: e78b2bc4-2cb4-4b85-9281-3c6c7bb2ae0f
  implicitFlowEnabled: false
  import: false
  loginTheme: ""
  name: harbor
  oauth2DeviceAuthorizationGrantEnabled: false
  oauth2DeviceCodeLifespan: ""
  oauth2DevicePollingInterval: ""
  pkceCodeChallengeMethod: ""
  realmId: sylva
  requireDpopBoundTokens: false
  rootUrl: ""
  serviceAccountUserId: ""
  serviceAccountsEnabled: false
  standardFlowEnabled: true
  standardTokenExchangeEnabled: false
  useRefreshTokens: false
  useRefreshTokensClientCredentials: false
  validRedirectUris:
    - https://harbor.sylva.172.20.136.176.nip.io/c/oidc/callback
  webOrigins:
    - https://harbor.sylva.172.20.136.176.nip.io
conditions:
  - lastTransitionTime: "2026-06-11T07:48:33Z"
    reason: Available
    status: "True"
    type: Ready
  - lastTransitionTime: "2026-06-19T14:33:01Z"
    observedGeneration: 3
    reason: ReconcileSuccess
    status: "True"
    type: Synced
  - lastTransitionTime: "2026-06-11T07:48:31Z"
    reason: Success
    status: "True"
    type: LastAsyncOperation

We need to add healthChecks, in a way that does not repeat the healthCheck definition.

One idea here for this: !8307 (comment 3473925759)