Feature: support for group management with authd-oidc broker

### Is there an existing request for this feature?

- [x] I have searched the existing issues and found none that matched mine

### Describe the feature

I’m looking into adding support for retrieving groups from the Okta provider and wanted to clarify a few design questions before moving forward.

In Okta, there are two authorization server options:
- The Org Authorization Server (the built-in server for the org).
(e.g. `https://{yourOktaDomain}/oauth2/v1/authorize`)
- Custom Authorization Servers, which are more flexible and configurable.
(e.g. `https://{yourOktaDomain}/oauth2/{authorizationServerId}/v1/authorize`)

With the **Org Authorization Server**, we can configure the groups claim under the application to return groups matching a regex with the _id_token_ when `groups` scope is requested.

With the above configuration, the id_token contains the group names matching the regex and the list looks like,

With a **Custom Authorization Server** also, we can define a groups scope and a corresponding groups claim matching groups via regex.

The id_token similar to org auth server case also contains the group names matching the regex,

In both cases, it’s also possible to customise the groups claim to return a value such as `:`, instead of just the group name.

For org auth server,

For custom auth server,

Before proceeding with implementation, I’d like feedback on the following:

1. Should we introduce a dedicated authd broker for Okta to handle this properly, or should we extend the existing generic broker to support this?
2. Do we want to support only group names, or should we allow a custom expression that can include group IDs as well (for example `:`)?

Here is a doc from okta which I followed while trying this out.
https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/

### Describe the ideal solution

1. I feel adding a dedicated broker for okta is the right thing as the implementation of the feature would be okta specific and not generic mostly.
2. I feel that allowing a custom expression that returns both the group ID and the group name could be useful in the long run. It would give us more stability if group names are renamed in Okta. And I already verified that it is possible with both org and custom authorisation servers.

### Alternatives and current workarounds

_No response_