FR: New "User matching mode" - Use the user's username, but instead of deny, allow the user to change username

**Is your feature request related to a problem? Please describe.**
The problem is that I want to use external IdP's usernames, but not not deny enrollment if one already exists with the same name.

**Describe the solution you'd like**
I want to use external IdP's usernames, but if one already exists, it should allow the user to either login with existing credentials or allow the external IdP user to change the username so it doesn't clash.

**Describe alternatives you've considered**
N/A

**Additional context**
If you have social login with eg 3rd party Keycloack, and want to use their right usernames, but only ask to change it if it would otherwise clash.

No files, tests, or entry points are named in the issue. Start by tracing the external IdP enrollment username-matching and collision-denial flow; done means an existing username can follow the existing-credentials path, while a colliding IdP user can choose a non-conflicting username.

Written by the indexing model from the issue text.