oidc handling of usernames

[thmo]

Please describe what you would like to see in ContainerSSH

Please implement enforceUsername also for the oidc authentication method.
Furthermore, logging could be improved.

Please describe your use case

Using ContainerSSH 0.5 (actually with PR ContainerSSH/libcontainerssh#563 applied) with Keycloak and this configuration

auth:
  keyboardInteractive:
    method: oauth2
    oauth2:
      clientId: "containerssh"
      clientSecret: "..."
      provider: oidc
      oidc:
        deviceFlow: true
        authorizationCodeFlow: false
        usernameField: "preferred_username"
        url: "https://KEYCLOAK_URL/realms/REALM/"

one can login using any username (ssh -l foo ...), and user matching authenticatedUser is not enforced.

Two things:

• it would be nice to enable checking of this without implementing an authorization hook
• furthermore, it would be nice to log not only the requested user but also the authenticatedUser, even on log level info.