Custom auth flow support and OAuth2/OIDC plugin

[intelfx]

Preliminary implementation of a pluggable authentication flow architecture, with the OAuth/OAuth2 backend as the first user thereof.

Credits: #156

---

This implementation accepts configuration under the kvmd.auth.flows.oauth key, as follows:

kvmd:
  auth:
    flows:
      oauth:
        enabled: true
        providers:
          github:
            type: oauth2
            client_id: myclient
            client_secret: mysecret123
            access_token_url: https://github.com/login/oauth/access_token
            authorize_url: https://github.com/login/oauth/authorize
            base_url: https://github.com/
            user_info_url: https://api.github.com/user
            short_name: GitHub
            long_name: GitHub
            scope: openid user
            username_attribute: email
          keycloak:
            type: oauth2
            client_id: client2
            client_secret: str
            access_token_url: https://sso.keycloak.my.tld/realms/master/protocol/openid-connect/token
            authorize_url: https://sso.keycloak.my.tld/realms/master/protocol/openid-connect/auth
            base_url: https://sso.keycloak.my.tld/
            user: https://sso.keycloak.my.tld/realms/master/protocol/openid-connect/
            short_name: Keycloak
            long_name: My Keycloak
            scope: openid profile
            username_attribute: sub

UI-wise, each provider corresponds to a separate button on the login page which triggers the corresponding auth flow.

API-wise, the new APIs are located under /api/auth/flow/oauth/{key}. The name of a section under kvmd.auth.flows.oauth.providers (e.g., github or microsoft) is an arbitrary URL-safe string, and it is used as the {key} in the base URL above.

The callback URL will be {pi-kvm}/api/auth/flow/oauth/{key}/callback. You will have to whitelist that URL in the OAuth authorization server in use.