Implement first (simple/PoC) version of a OIDC auth provider

[poikilotherm]

This is part of epic #5974.

---

Since the refactoring of OAuth2 infrastructure in #5991 and #6364 it was made possible to introduce a new authentication mechanism using the Nimbus OAuth 2.0 SDK with OpenID Connect extensions.
(ScribeJava has a long missing feature request for OIDC support, which has never been attacked).

This first implementation should enable us:

• load a configuration
• retrieve metadata
• login at the provider
• retrieve standardized claims like email, name, ...
• allow multiple providers so it can be reused for different IdPs without touching codebase