Support trusted claims from identity providers

[nichtich]

Allow providers to pass account attributes such as affiliation.

Required for NFDI, see https://iam.services.base4nfdi.de/attributes/ and #119

To be used in jskos-server for extended access control, see gbv/jskos-server#232

To be discussed:

• some attributes can be modified freely, some are trused from a particular identity provider
• should attributes be embedded in JWT or pass via web socket?

Use case: https://doc.nfdi-aai.de/attributes/

[nichtich]

Claims should be arbitrary key-value pairs with flat string values. What about repeatable and nested additional data?

NFDI Infrastructure Attribute Profiles (IAP) seems to support (bold=mandatory) among others:

• OpenID Connect claims sub, iss, email, name, given_name, family_name
• voperson_id (there is no id?!)
• voperson_verified_email (in some cases there is no email) - not required by now but could be useful later
• org_domain
• eduperson_scoped_affiliation - not fully specified yet?
• voperson_external_affiliation
• eduperson_assurance (array)

Maybe OpenIDConnect provider should be configurable with a list of claims/keys to support and all other fields are ignored/filtered out.

[nichtich]

Also document common identity field names (name, uri (optional), maybe email) in contrast to additional custom claims.