feat: implement sso auth via OIDC

[justinhschaaf]

This PR makes the necessary changes to enable SSO authentication via OIDC.

• When navigating to /auth/oidc/login, users will be redirected to the OIDC provider to sign in.
• The OIDC provider will return a ResponseToken to /auth/oidc/response, from which we decode the JWT and save the claims (user data) in a cookie.
• When the user accesses an api route protected by the AuthenticatedUser request guard, the server will do the following:
  • Check for the JWT cookie and make sure it is not expired.
  • Check for an accompanying user cookie. If this cookie is present, the server makes sure the session as stored by PigWeb is not expired either.
  • If the user cookie is not present, check to see if the user exists in the database. If not, creates a new user with the info from the JWT.

Remaining Challenges:

• Making the client provide the session cookies to the server. Depends on Add Request::credentials for web emilk/ehttp#62.

[justinhschaaf]

was initially running into the following error during testing:

Error: Unable to parse or validate JWT: Error(InvalidAlgorithm)

doing some digging into Authentik's source code, it only signs the JWT with the client secret + HS256 algorithm when no other certificate is set. updating the provider to use "-------" as the signing key got a different error message.

• somehow this was changed back to the self-signed certificate later, but it still bypassed that first error. i already had a headache today, i'm not gonna question it.

Error: Unable to parse or validate JWT: Error(InvalidAudience)

the audience should just be the client id, and i double checked it's set properly. most likely this just needs to be passed to the jsonwebtoken library.

[justinhschaaf]

had to disable alg validation to get rid of the InvalidAlgorithm error message, but passing the client id to the validator lets OIDC work on the server-side. need to update the client with login ui next

[justinhschaaf]

there's still some quirks with this, e.g. client data handler errors out when a request fails due to your session expiring instead of just telling you, but improving the error handling can be done in the main branch. the core objective of this PR--implementing OIDC--is complete. 🎉