OIDC: enable mapping `groups` claim to user groups

[poikilotherm]

Overview of the Feature Request

Currently, we cannot make the OIDC provider put remote users into certain groups based on the groups claim that can be received from an identity provider. This is crucial for SPA functionality and other use cases.

What kind of user is the feature intended for?
Sysadmin

What inspired the request?
The upcoming SPA and working on #9268

What existing behavior do you want changed?
Map users to groups using admin specified configuration.

Any brand new behavior do you want to add to Dataverse?
Nope

Any open or closed issues related to this feature request?
#9268 #8349 #6679 #5974

[cmbz]

2024/01/08: @scolapasta will follow up with Oliver to discuss.