IdP OIDC organization/affliation required

There is a need to make sure that a logged-in user has certain attributes come from the IdP such as organization or affliation. Different IdPs can send different attributes and we should check that at least one exists.

- [ ] new config `oidc-required-affliation`, a sequence of attributes that are checked in order to find at least one
- [ ] if none of the required attributes are present, show an error page ~ "sorry, we can't find your affliation, please contact your IdP"
- [ ] log the error