Allow linking upstream accounts for existing users when the localpart matches in upstream OAuth 2.0 logins

[mcalinghee]

Fixes Point 1 and 4 in #2089

• do nothing, and fail the registration/login (corresponds to allow_existing_users: false in Synapse)
• import the link without overriding existing links for this user (corresponds to allow_existing_users: true in Synapse)
  import the link if and only if there is no existing link for this user

Introducing new configuration on_conflict in section claims_imports.localpart to set the account linking strategy

upstream_oauth2:
  providers:
    - id: 
      claims_imports:
        localpart:
          action: require 
          on_conflict: add

• fail (default value): do nothing, and fail the registration/login (corresponds to allow_existing_users: false in Synapse)
• add : import the link without overriding existing links for this user (corresponds to allow_existing_users: true in Synapse)
• replace : import the link and replace any existing link for this user => not implemented in this PR
• set : import the link if and only if there is no existing link for this user => not implemented in this PR

confirmation page when configuration is on_conflict: add :

[odelcroi]

Wrong configuration of provider

When activating the option allow_existing_users : true, the claim username is used to check if users exist or not. If the attribute mapper username is set to ignore or suggest , the user existence is not checked. Therefore to enable this option the username attribute mapper should be set to require or force.

• documentation should mention it
• an error should be raised at startup if the configuration does not respect this condition

[odelcroi]

@sandhose I'm done with the required modifications, I think we can consider updating the user flow by skipping the screen in a second step. If good with you, we can merge :)

[sandhose]

Thanks! Almost there, just a few minor stylistic things, but I think this should make the cut for the next RC on Tuesday!

[sandhose]

Many thanks! It should be part of the 0.20.0-rc.0 tomorrow 💃