Support nonce and acr with OIDC + Tests

[fflorent]

Context

• Some Identity provider don't support PKCE and instead impose Nonce;
• They also may impose passing some ACR values;
• And require to pass the state and the idToken in the logout

Proposed solution

• Introduce the GRIST_OIDC_IDP_ENABLED_PROTECTIONS variable who can contain comma-separated values with either: STATE, NONCE and PKCE, and defaults to STATE,PKCE;
• Introduce the GRIST_OIDC_IDP_ACR_VALUES variable with space separated values;
• Once logged in (after the callback), store the state and the idToken for the logout, and clear any other values;
• Introduce unit tests with mocks;
• Also redirect to the error page when something went wrong while signing in;

[fflorent]

Opening the PR for checking whether the tests work in the CI

[fflorent]

@SleepyLeslie I sent you in private everything you need to try my PR using Agent Connect. Please keep me informed otherwise.

[SleepyLeslie]

Thanks @fflorent for the updates and Agent Connect info. I'm waiting for an approval to sign up for Agent Connect. I'll get back to you as soon as I finish testing. Otherwise this looks good to me now, and should be able to get merged soon!

[fflorent]

@SleepyLeslie Hmm, I have given the env variables to use, but using your own email won't work.
There are credentials to use and some simple questions to answer, but asked in French.

I suggest we take some time to take a look at that together if you want to, that will be probably simpler and faster. It may take 10 / 15 minutes in case testing is just what you need, or more if you have questions regarding my developments.

I send you an email to see what slot we could find.