Add DEX support to openondemand role

[sjpb]

Adds support for DEX as an authentication option for OpenOndemand. Typically this could be used to enable authentication against LDAP, instead of using the basic_auth/PAM configuration.

Note the dex package must be added in an extra image build using e.g.

TODO

Also modernises the default Open Ondemand configurations by removing the in-role defaults for user_map_cmd and user_map_match options. User mapping in current Open Ondemand versions is now by default done via a regex instead of a command and usually the underlying osc.ood role / OpenOndemand default of mapping the entire remote user claim to the system user is appropriate. If not, the osc.ood role variables such as user_map_match may be set directly, and duplicating defaults for those here is not necessary.