Merging of users

[BeryJu]

Currently, on enrollment via a Source, a decision is made whether to create a new user or authenticate an existing user.

This decision is made using the following criteria:

• OAuth Source:
  If the request is authenticated, the OAuth identity is assigned to the currently authenticated user.
  If the identifier has been saved before, the user is authenticated
  Otherwise, a new user is created
• SAML Source
  Depending on the NameID Policy of the remote IDP, a user query is done.
  If a user is found, they are authenticated. Otherwise a new user is created
• LDAP Source has a special attribute, but since this source doesn't use an interactive flow, so it'll stay as is.

The goal is for the admin to be able to configure if and on which criteria a user is created or merged, and if the enduser has a choice.

If the enduser can select between merging and creating a new account, they will have to authenticate their existing account in some form.