Allowed users ACL

[laurivosandi]

Either add allowedUsers attribute to OIDCGWClient spec or include a username derived string in the groups claim (that does not collide with any existing ones). In the latter case it might be sensible to allow specifying Slack ID, Github username, Github profile ID and pretty much any attribute as the criteria.

On the other hand username would always be the local anchor so that could suffice. Maybe just including plain username in the groups claim would work? Usernames aren't allowed to contain : thus collisions should be avoided