[IMPROVE] Condition Custom OAuth authentication to the presence of arbitrary user roles

Description:

On my rocket chat instance, all users are provided by Keycloak as a custom OAuth provider.
Some users are allowed to use rocket chat, while some are not.

Steps to reproduce:

1. Setup a Custom OAuth in RC
2. Try to tell RC what subset of users coming from the OAuth provider is allowed to use RC

Expected behavior:

I want to be able to declare a list of required roles in the RC Custom OAuth configuration.
If a user misses one of these roles, RC should fail authentication. If a user has all roles, the authentication should proceed as usual.

Actual behavior:

Today, all users provided by Keycloak are able to authenticate on RocketChat. There is no way to exclude or include a subset of OAuth provider users.

Server Setup Information:

• Version of Rocket.Chat Server: 3.9.3
• Operating System: Ubuntu 20.04
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog: Default
• NodeJS Version: docker one
• MongoDB Version:4.0

Client Setup Information

• Desktop App or Browser Version: Chrome
• Operating System: Ubuntu 20.04

Start by locating the Custom OAuth configuration and authentication flow in Rocket.Chat, then review how users from providers such as Keycloak are accepted. Done means the configuration can declare required roles, users missing any required role fail authentication, and users with all roles authenticate as before.