Add support for single sign-on (SSO) through OIDC (implemented)

[gjazali]

I'd like to add the ability for Fizzy to sign people in through one OpenID Connect (OIDC) identity provider for the whole server. I made the implementation in #3167 if anyone would like to review it and give feedback (the Copilot review says that it needs a "final human validation"). I made screenshots of the UI there as well.

This change would address #2253. And it works like #2370 and handles account access for each user through groups configured in the IdP, so it's easy to grant or revoke access on a scale.