Feature Request: Enforce a username convention for OIDC logins

Overview of the Feature Request

When a user logs in using an OIDC provider, such as Keycloak, they are allowed to choose any username for their Dataverse ID. I would like to be able to enforce that user's use their email address (from the OIDC provider) as their Dataverse ID (or up to the @ symbol, bob@foo.org would have the ID bob).

What kind of user is the feature intended for?

All users logging in through OIDC.

What inspired the request?

Our academic institution would like to maintain a single 'username' for all users. That way, the username is consistent for all of our campus services. We are concerned when deploying our initial Dataverse environment that users are able to use arbitrary usernames.

Modifications / Additions to Dataverse Behavior

• Administrators should be able to disable user's picking arbitrary usernames.

• Usernames should be (optionally) derived from the authentication provider itself (for example, OIDC).

Any open or closed issues related to this feature request?

• https://github.com/IQSS/dataverse/issues/6690

The issue does not name files, tests, or entry points. Start by tracing the OIDC login flow and username-selection step, then clarify the administrator setting and email-derived ID rules; done means OIDC users cannot choose arbitrary IDs when enforcement is enabled and can retain the existing choice when it is disabled.