[Bug] Avatar not set from Custom OAuth2 service (KeyCloak)

Description:

Since 4.0 only one way to fill some user fields from LDAP and OAuth is user log in to RocketChat.
Now I'm testing 4.1.0 version and see, that login via LDAP set avatar from LDAP correctly.
And when I'm log in via KeyCloak - avatar not set.

Steps to reproduce:

1. Setup custom OAuth2 service (KeyCloak) with mapping some field to avatar
2. Log in via KeyCloak
3. User haven't avatar setup

Expected behavior:

User should get avatar after log in via KeyCloak

Actual behavior:

LDAP settings

LDAP log in

KeyCloak settings

KeyCloak login

Server Setup Information:

• Version of Rocket.Chat Server: 4.1.0
• Operating System: CentOS7
• Deployment Method: docker
• Number of Running Instances: 12
• DB Replicaset Oplog: Enabled
• NodeJS Version: 12.22.1
• MongoDB Version: 4.2.12 / wiredTiger (oplog Enabled)

Client Setup Information

• Desktop App or Browser Version: Electron 3.1.1
• Operating System: Windows 10

Additional context

TmuszH654Mvum9XBY - user created via KeyCloak login.

Relevant logs:

{"level":35,"time":"2021-11-01T09:46:17.188Z","pid":8,"hostname":"cb39a002475f","name":"Meteor","method":"stream:local","userId":null,"remoteIP":null,"instanceId":"Tfrr8ubh7q6nFYj8L"} 
{"level":35,"time":"2021-11-01T09:46:36.502Z","pid":8,"hostname":"cb39a002475f","name":"Meteor","publication":null,"userId":"TmuszH654Mvum9XBY","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Electron/10.1.6 Safari/537.36","remoteIP":"172.16.72.32","instanceId":"Tfrr8ubh7q6nFYj8L"} 
{"level":35,"time":"2021-11-01T09:46:36.545Z","pid":8,"hostname":"cb39a002475f","name":"Meteor","method":"stream:local","userId":null,"remoteIP":null,"instanceId":"Tfrr8ubh7q6nFYj8L"} 
{"level":35,"time":"2021-11-01T09:46:36.555Z","pid":8,"hostname":"cb39a002475f","name":"API","method":"GET","url":"/api/v1/commands.list","userId":"TmuszH654Mvum9XBY","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Electron/10.1.6 Safari/537.36","host":"rc.testqa.ru","referer":"https://rc.company.com/home","remoteIP":"172.16.72.32","status":200,"responseTime":3} 
{"level":35,"time":"2021-11-01T09:46:36.575Z","pid":8,"hostname":"cb39a002475f","name":"API","method":"POST","url":"/api/v1/method.call/license:getModules","userId":"TmuszH654Mvum9XBY","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Electron/10.1.6 Safari/537.36","length":"96","host":"rc.testqa.ru","referer":"https://rc.company.com/home","remoteIP":"172.16.72.32","status":200,"responseTime":1} 
{"level":35,"time":"2021-11-01T09:46:36.589Z","pid":8,"hostname":"cb39a002475f","name":"Meteor","method":"listCustomUserStatus","userId":"TmuszH654Mvum9XBY","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Electron/10.1.6 Safari/537.36","referer":"https://rc.company.com/home","remoteIP":"172.16.72.32","instanceId":"Tfrr8ubh7q6nFYj8L"} 
{"level":35,"time":"2021-11-01T09:46:36.592Z","pid":8,"hostname":"cb39a002475f","name":"API","method":"POST","url":"/api/v1/method.call/listCustomUserStatus","userId":"TmuszH654Mvum9XBY","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Electron/10.1.6 Safari/537.36","length":"98","host":"rc.testqa.ru","referer":"https://rc.company.com/home","remoteIP":"172.16.72.32","status":200,"responseTime":5} 
{"level":35,"time":"2021-11-01T09:46:36.607Z","pid":8,"hostname":"cb39a002475f","name":"API","method":"GET","url":"/api/apps/languages","userId":"TmuszH654Mvum9XBY","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Electron/10.1.6 Safari/537.36","host":"rc.testqa.ru","referer":"https://rc.company.com/home","remoteIP":"172.16.72.32","status":200,"responseTime":1} 

Start by tracing the LDAP and custom OAuth2 login paths, comparing how each maps user fields and handles the avatar value. Reproduce the KeyCloak configuration described in the issue and verify the mapped avatar during login; done means a newly created user receives the configured avatar.