Implement MSC3861 support for OIDC authentication

[tcpipuk]

Many server admins prefer to centralise their authentication, so they can use a single system for login across all of their applications, then use one (ideally MFA) system for their users to login.

This simplifies user management, but also helps avoid requests for user management features, as password management and 3PID are handled by the OIDC provider instead of the Matrix server.

The overall MSC3861 exists for this, and has not yet been merged, but it's approaching maturity and MSC2964 specifies a comprehensive list of endpoints a server would require to handle OIDC authentication.

[zoujiaqing]

Good!
This feature is very good!

[zoujiaqing]

conduit support OIDC status:
https://gitlab.com/famedly/conduit/-/merge_requests/587

[wrenix]

Moved to here:
https://gitlab.com/famedly/conduit/-/merge_requests/676

[morguldir]

That's legacy SSO from my understanding, still interesting though