Whitelist newly registered users

When using OIDC with a public IdP, the administrator usually doesn't want to enable auto registration, as not everyone should be able to have an account.

With disabled auto registration, an OIDC login is rejected and there is no way to whitelist one specific user. Gotify could create the account but keep it locked until an admin approves it, similar to Gitea/Forgejo. This could work as a new auto-register option (like false / true / locked) for both OIDC and normal sign-ups.

https://github.com/gotify/server/pull/977#discussion_r3409612051

Start with the linked pull request discussion, then trace the OIDC login, auto-registration setting, and normal sign-up paths in the Go server. Define how a locked account is created and approved by an administrator, and verify that the new registration behavior works for both OIDC and normal sign-ups.

Written by the indexing model from the issue text.