Add ability to configure OAuth / OIDC endpoint formats

**Is your feature request related to a problem? Please describe.**

I have a backend network where I host some servers that I restrict as much as possible from connecting to the outside directly, not fully air-gapped but as much as practical in my setup.

These servers should not be able to send requests to my intranet frontend web loadbalancer, but they can however talk directly to authentik on the backend network.

This causes an issue when using OAuth to authenticate, since the user accesses `https://myapp.restricted.example.com:443`, and the my-app server then talks to authentik directly on the restricted network via `https://authentik.restricted.example.com:9443/application/o/myapp/` (different sub-domain and port, and network entirely), the my-app then redirects the user to that `https://authentik.restricted.example.com:9443/application/o/authorize/` on the restricted network where the user that is on the general intranet does not have access.

The user has access to authentik via the intranet loadbalancer to log in, but that is only accessible to the user via `https://authentik.intranet.example.com:443/application/o/authorize/`, and not the restricted network. So when the user tries to login to the app, the app redirects the user, who then gets nowhere as the page can not connect.

**Describe the solution you'd like**

Option to configure the "Authorize URL" / `authorization_endpoint` for the OAuth 2.0 provider so I could set it to something like `"{TRANSPORT}://authentik.intranet.{DOMAIN_TLD}:{PORT}/application/o/authorize/"`

Even better if possible to use a regex + replace style, maybe something like `{/str/regex/replace/}` so in the example it could be configured as `{TRANSPORT}://{/{DOMAIN}/^(.*)\.restricted\.(.*)$/\1.intranet.\2/}:{PORT}/application/o/authorize/`

**Describe alternatives you've considered**

- Less restrictive access to the frontend network from the backend network.
- Adds attack surface for extracting information
- Split horizon DNS between the frontend and backend networks.
- Non standardized setup on some nodes, increasing documentation workload and slows down as customized nodes need special precedures
- Add HTTP redirect on the frontend loadbalancer.
- Port 9443 must be opened into the loadbalancer on all relevant points of ingress

**Additional context**

I created a support thread in the discord server: https://discord.com/channels/809154715984199690/1431620663747280917