fix(auth0): map given_name/family_name to User (#430)

[yabanci]

What

Closes #430.

providers/auth0/auth0.go:userFromReader only extracted a subset of the OIDC claims returned by Auth0's /userinfo endpoint:

type auth0UserResp struct {
    Name      string `json:"name"`
    NickName  string `json:"nickname"`
    Email     string `json:"email"`
    UserID    string `json:"sub"`
    AvatarURL string `json:"picture"`
}

given_name and family_name — standard OIDC claims that Auth0 returns alongside name/email/sub — were silently dropped, even though goth.User has FirstName and LastName fields ready for them. The reporter (@justman00) hit this while wiring Auth0 to a goth.User consumer.

Change

Add the two fields to auth0UserResp and map them in userFromReader. Matches how the Google provider already handles the same OIDC claims (providers/google/google.go:googleUser):

FirstName string `json:"given_name"`
LastName  string `json:"family_name"`

user.FirstName = u.FirstName
user.LastName  = u.LastName

Scope

The reporter also listed email_verified, locale, and updated_at as unmapped. None of these has a typed slot on goth.User (no EmailVerified, no Locale), so promoting them to typed fields would require adding fields to the shared goth.User struct — out of scope for an Auth0-specific bug fix, and visible to every provider. Those claims already land in user.RawData and remain readable from there. I added an assertion to Test_FetchUser to lock that contract in so future refactors don't silently drop them.

Backward compatibility

Strictly additive — no existing field's mapping is touched. Callers that read user.FirstName / user.LastName from Auth0 used to get empty strings and now get the real values. Callers that don't read them are unaffected.

Tests

Extended Test_FetchUser to:

1. Include given_name/family_name in the sample /userinfo response.
2. Differentiate name from given_name/family_name so each assertion exercises a distinct claim (the existing sample used the email address for name, which hid this exact class of bug).
3. Assert u.FirstName == "Test", u.LastName == "User".
4. Assert u.RawData["email_verified"] == false to lock the RawData fallback contract.

Verified the new assertions fail on master (FirstName/LastName come back empty), pass with the fix applied. Full go test ./... is green across all 50+ providers; go vet ./... is clean.