Normalize string-type OIDC claims to arrays

[MintBlueJelly]

This pull request refactors the logic for extracting user roles from OIDC claims in the deriveRolesFromClaims function to improve robustness and code readability. The main change is the introduction of a helper function to consistently handle claim values that may be arrays or single values.

Improvements to role extraction logic:

• Added a toArray helper function to ensure that claims.groups, claims.roles, and claims.entitlements are always treated as arrays. This ensures single string-type values (as returned e.g. by JumpCloud when a user is only a member of a single group) are not discarded but preserved.

#279