OAuth: Make sub claim required for generic oauth

[kalleep]

What is this feature?
Make sub claim required for generic oauth. We still handle the case where a auth connection was made without a valid AuthID and patches it during user sync.

• Special case

  grafana/pkg/services/authn/authnimpl/sync/user_sync.go

  Lines 339 to 347 in a8e211b

  	// Special case for generic oauth: generic oauth does not store authID,
  	// so we need to find the user first then check for the userAuth connection by module and userID
  	if identity.AuthenticatedBy == login.GenericOAuthModule {
  	query := &login.GetAuthInfoQuery{AuthModule: identity.AuthenticatedBy, UserId: usr.ID}
  	userAuth, err = s.authInfoService.GetAuthInfo(ctx, query)
  	if err != nil && !errors.Is(err, user.ErrUserNotFound) {
  	return nil, nil, err
  	}
  	}

• Patching

  grafana/pkg/services/authn/authnimpl/sync/user_sync.go

  Line 192 in a8e211b

  func (s *UserSync) upsertAuthConnection(ctx context.Context, userID int64, identity *authn.Identity, createConnection bool) error {

Which issue(s) does this PR fix?:
Fixes #https://github.com/grafana/identity-access-team/issues/603

Release notice breaking change

Authentication with generic oauth now requires sub claim to be present in either ID-Token or API response

[aarongodin]

Nice, LGTM

[eleijonmarck]

there is no featuretoggle?

[kalleep]

Closing in favor of #85065