feat: synchronize oidc user roles

[Emyrk]

Closes #7470

What this does

Pulls the user's roles from the OIDC claims. Works almost identically to the group sync.

Role mapping is 1:many. So 1 role in OIDC can map to multiple coder roles.

--oidc-user-role-mapping='{"TemplateAuthors":["template-admin","user-admin"]}'

A new entitlement was added to control this feature

Behaviors

• If you log in, but the roles claim is missing you will be demoted to a member. This is because there is no way to tell between an empty list claim and a missing claim. So turning on this feature with a bad OIDC config could revert all members on the site to members.
• If you try to manually update an OIDC user's roles with this turned on, you will get an error.

Edit roles

You cannot manually assign roles to OIDC users since it is now controlled by this user role sync.

Users page

(@BrunoQuaresma might want to style this later)

Log message if extra roles provided

[API] 2023-07-19 17:30:42.248 [debu]  coderd.userauth: OIDC roles ignored in assignment  user_id=5b775ca4-4d4a-4f3f-964e-356b9634f040  request_id=659d77bd-a472-4142-a9af-2ebbf6397fbf ignored=[TemplateAuthors]  assigned=[]

[Emyrk]

I am adding LoginType to the /users struct.

This issue is being resolved soon with some open PRs I have: #5002

With this change, only admins can read users, so exposing this field is ok.
This solves some UI issues with this PR on not allowing role changing, and showing login type here: #8346