[SECURITY-208] Validate the hd claim

If the user configures a "Google Apps Domain", then the hd claim of the
JSON Web token must be validated as matching that configured domain.

https://developers.google.com/identity/protocols/OpenIDConnect?hl=en#hd-param

src/main/java/org/jenkinsci/plugins/googlelogin/GoogleOAuth2SecurityRealm.java

@@ -28,6 +28,8 @@
import com.google.api.client.auth.oauth2.ClientParametersAuthentication;
import com.google.api.client.auth.oauth2.Credential;
import com.google.api.client.auth.oauth2.TokenResponse;
import com.google.api.client.auth.openidconnect.IdToken;
import com.google.api.client.auth.openidconnect.IdTokenResponse;
import com.google.api.client.http.GenericUrl;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
@@ -168,7 +170,12 @@ public HttpResponse doCommenceLogin(@QueryParameter String from,  @Header("Refer
            @Override
            public HttpResponse onSuccess(String authorizationCode) {
                try {
                    TokenResponse response = flow.newTokenRequest(authorizationCode).setRedirectUri(buildOAuthRedirectUrl()).execute();
                    IdTokenResponse response = IdTokenResponse.execute(
                            flow.newTokenRequest(authorizationCode).setRedirectUri(buildOAuthRedirectUrl()));
                    IdToken idToken = IdToken.parse(JSON_FACTORY,response.getIdToken());
                    if (domain != null && ! domain.equals(idToken.getPayload().get("hd"))) {
                        return HttpResponses.errorWithoutStack(401, "Unauthorized");
                    }
                    final Credential credential = flow.createAndStoreCredential(response, null);

                    HttpRequestFactory requestFactory =