SSO: support non-toplevel attribute_requirements

This issue has been migrated from [#14835](https://github.com/matrix-org/synapse/issues/14835).

---

**Description:**

To the best of my knowledge, it is only possible to configure and check attribute requirements if the attribute is in the toplevel of the claim/access token.

**Example**
We use keycloak as OIDC provider. The access token of keycloak contains:
```json
"resource_access": {
"{client-id}": {
"roles": [
"{client-role-1}",
"{client-role-2}",
]
}
},
```
I want to allow authentication based on a assigned client-role which is nested inside multiple objects.

**Possible solution**
A solution could be to allow dot-notation for the attribute requiremtes to access nested elements
```yaml
# homeserver.yaml
oidc_providers:
- idp_id: keycloak
{...}
attribute_requirements:
- attribute: resource_access.{client-id}.roles
value: {client-role-1}
```