Provide custom user mapping logic via expression

**Is your feature request related to a problem? Please describe.**
When I am trying to add a trusted OIDC provider, I find it difficult with some sources to map to users properly.

**Describe the solution you'd like**
I would like for the ability to provide the usermapping via an Expression, this would allow for me in this instance. Use the subject line in the incoming JWT subject of `project_path:mygroup/myproject:ref_type:branch:ref:main ` and map `project_path:mygroup/myproject*` to `serviceUser_project_001`

If I have not provided that mapping, to just flat out deny auth to that endpoint.

**Describe alternatives you've considered**
Any sort of custom user mapping would be nice, to do something like string matching