not supported in firefox 68

The keycloak library currently only sends us an event in case the token
is about to expire, which is problematic because there is a time window
where we don't have a new token yet and on mobile the timers used
might be suspended and come too late.

To avoid this we check every 10 seconds that the token is valid for 30
and to work around suspended timers we also check on "visibilitychange"
which should trigger then the website gets visible again after the browser
sleeps.

idpHint is only a login option, not an init one

npm has started to complain that yarn uses a different node binary,
so just use yarn everywhere.

While this shouldn't make a difference because the callback should
only be called when the token is about to be expiring there
is no reason to keep the old token around.

Just force a refresh always

We no longer bundle keycloak-js with rollup so we can remove those
special cases.

This makes sure the library version works with the server version.

Ideally we'd also want to check the version so we can error out if a too
old keycloak server is on the other side, but I don't see any public API changes
that would allow us to know if the library is too old.

Fixes #32

See #32

I couldn't find any breaking changes affecting us

it's unused atm

Instead of hardcoding the paths of the node_modules directory we use the node-resolve
plugin of rollup to find the root of the corresponding JS package and calcucate a path from
there.

Resolving a package requires calling an async function, so we have to use await in the rollup config.
Luckily rollup supports configs wrapped in a promise, so we just have to wrap it in a function which returns
a promise.

Since they are no longer in separate repos we no longer need the
gitlab CI config files.

We couldn't do this until now because we referenced them by a relative path with npm.
But now that we reference them by name and yarn handles the linking we can
specify them as normal dependencies.

They are not published yet

This switches bak to the original lookup algo. Required since we
now use lerna which moves the common deps to the root package.

lit-html no longer allows merging them in literals.

our CI can't handle it

Now that we have a separate component for keyclaok we can move those
keycloak specific settings into their own attributes.

This should make it more clear what the components are used for

vpu-auth listens to login/logout events which the button emits
and the button shows data from the auth-update event.

Same hover effect, padding and cleanup the CSS etc.

It should only span the whole width in mobile mode

This should make it work in all (LTR at least) cases.