add support for auth via oidc mode

[elfkuzco]

Rationale

This is a port of openzim/zimfarm#2013 to the CMS to enable authentication via OIDC mechanism

Changes

• see Usage of ory.sh OIDC flow in Zimfarm is missusing the ID Token kiwix/overview#175
• backend:
  • always create an account when a JWT arrives with an unknown sub (even for machines): when name is unknown, simply use sub as display name until it gets updated by a Zimfarm admin
  • clarify variable namings
    • OAUTH_OIDC_CLIENT_ID => OAUTH_OIDC_AUDIENCE (we use it only to check audience in the JWT)
    • OAUTH_SESSION_AUDIENCE_ID => OAUTH_SESSION_AUDIENCE (audience ID is meaningless, it is an audience and a client ID ; choosing audience for clarity)
    • CREATE_NEW_OAUTH_ACCOUNT => OAUTH_CREATE_NEW_ACCOUNT
  • share code in both OAuth kinds to detect humans vs machine when receiving a JWT
  • OIDC: source aal and name from new ext.kiwix-aal and ext.kiwix-name claims
• frontend:
  • OIDC:
    • use the access_token instead of the id_token (save it in local storage + send it to the API)
    • when initiating the auth flow at /oauth2/auth, specify the audience (backend client ID) the access_token is intended for
    • add a new setting to allow the distinction between OAUTH_CLIENT_ID(the UI client ID) from OAUTH_AUDIENCE (the backend client ID)
• update integrator guide to clarify what needs to be configured in backend/frontend regarding OAuth

This closes #506

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.78%. Comparing base (a2b2a8b) to head (77eea82).

Files with missing lines	Patch %	Lines
backend/src/cms_backend/api/token.py	83.78%	5 Missing and 1 partial ⚠️
backend/src/cms_backend/api/routes/dependencies.py	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #508      +/-   ##
==========================================
+ Coverage   81.48%   81.78%   +0.29%     
==========================================
  Files          69       69              
  Lines        4365     4397      +32     
  Branches      511      515       +4     
==========================================
+ Hits         3557     3596      +39     
+ Misses        645      640       -5     
+ Partials      163      161       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[benoit74]

Small remarks

[benoit74]

LGTM, please ping me before merging this so that I switch prod config at the same moment