Add some generic bits about integrating with external IDP

[rhafer]

This takes some bits from the keycloak page which are bascially relevant for integrating with any external IDP and puts them in a separate section.
Also adds some bits about the claim based role assignment setup (taken from the proxy's service README).

[Copilot]

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (4)

docs/admin/30-configuration/30-authentication-and-user-management/10-external-idp.md:15

• Typo in 'openid-configuraton'; consider changing it to 'openid-configuration'.

- `PROXY_OIDC_REWRITE_WELLKNOWN`: Set this to `true` to expose the Identity Providers `.well-known/openid-configuraton` via the OpenCloud base url.

docs/admin/30-configuration/30-authentication-and-user-management/10-external-idp.md:17

• Typo in 'do now yet support'; consider revising to 'do not yet support'.

  help the oidc client, that do now yet support discovery via webfinger to locate the Identity Provider's configuration.

docs/admin/30-configuration/30-authentication-and-user-management/10-external-idp.md:35

• Typo in 'afore mentioned'; consider changing it to 'aforementioned'.

the mapping between the OIDC and LDAP users happens base on the afore mentioned `PROXY_USER_CS3_CLAIM` settings.

docs/admin/30-configuration/30-authentication-and-user-management/10-external-idp.md:37

• Typo in 'charcters'; consider changing it to 'characters'.

Set `GRAPH_USERNAME_MATCH` to `none` when `PROXY_AUTOPROVISION_ACCOUNTS` is set to `true` to disable OpenCloud's default restrictions on allowed charcters in usernames.