Epic: Add OIDC support to SSO

We should develop support for OIDC to extend our options when offering SSO. Currently we only offer SAML.

The OIDC support should ideally mimic the SAML integration as closely as possible - although there are likely improvements we can make around auto provisioning. For example, right now we don't support SCIM provisioning - is there an analogous approach we can implement in OIDC.