feat(bitbucket-server): Add API-driven pipeline backend for Bitbucket Server integration setup

[evanpurkhiser]

Implement get_pipeline_api_steps() on BitbucketServerIntegrationProvider with two steps: installation config (validates URL, RSA private key, and consumer key length, then fetches an OAuth 1.0a request token from the Bitbucket Server instance), and an OAuth callback step that builds the authorize URL from the request token and exchanges the callback's oauth_token (used by Bitbucket Server as the verifier) for an access token.

Legacy InstallationConfigView, OAuthLoginView, and OAuthCallbackView remain in place so in-flight installs can complete via the existing flow; they will be removed in a follow-up (VDY-103) once the API flow has been validated in production.

Ref VDY-99

[linear-code]

VDY-99

[sentry-warden]

Missing validation of oauth_token_secret causes uncaught KeyError in OAuthApiStep

The guard at line 323 only validates oauth_token but not oauth_token_secret; if the Bitbucket Server response includes oauth_token but omits oauth_token_secret, client.get_access_token() raises a KeyError on request_token["oauth_token_secret"] that is not caught by the except ApiError block in OAuthApiStep.handle_post, resulting in an unhandled 500.

Evidence

• InstallationConfigApiStep.handle_post (line 323) guards only request_token.get("oauth_token") before storing the token in pipeline state.
• OAuthApiStep.handle_post later calls self._client(pipeline).get_access_token(request_token, ...) inside try: ... except ApiError.
• BitbucketServerSetupClient.get_access_token (client.py line ~65) accesses request_token["oauth_token_secret"] as a bare dict key — no .get(), no fallback.
• KeyError is not a subclass of ApiError, so it propagates past the catch block as an unhandled exception.
• build_integration (integration.py line 572) also accesses access_token["oauth_token_secret"] directly, compounding the risk if the access-token response is similarly incomplete.

Suggested fix: Extend the existing guard to also validate oauth_token_secret.

Suggested change

	if not request_token.get("oauth_token"):
	lifecycle.record_failure(
	"missing oauth_token", extra={"url": validated_data["url"]}
	)
	if not request_token.get("oauth_token_secret"):
	lifecycle.record_failure(
	"missing oauth_token_secret", extra={"url": validated_data["url"]}
	)
	return PipelineStepResult.error("Missing oauth_token_secret")

_{Identified by Warden sentry-backend-bugs · RUP-A8A}