SSO: support non-toplevel attribute_requirements

[matrixbot]

This issue has been migrated from #14835.

---

Description:

To the best of my knowledge, it is only possible to configure and check attribute requirements if the attribute is in the toplevel of the claim/access token.

Example
We use keycloak as OIDC provider. The access token of keycloak contains:

  "resource_access": {
    "{client-id}": {
      "roles": [
        "{client-role-1}",
        "{client-role-2}",
      ]
    }
  },

I want to allow authentication based on a assigned client-role which is nested inside multiple objects.

Possible solution
A solution could be to allow dot-notation for the attribute requiremtes to access nested elements

# homeserver.yaml
    oidc_providers:
    - idp_id: keycloak
      {...}
      attribute_requirements:
        - attribute: resource_access.{client-id}.roles
          value: {client-role-1}