Automatically match Group Alias with OIDC groups claim

Background: Azure AD login with OIDC auth method.
Azure AD is passing the AD samaccountname group names via the groups claim in the ID Token.
Vault is setup to use one of the group names setup via roles/group-alias.

Current behavior: if i leave the role field blank in the OIDC browser login, it defaults to the default group specified in Vault's Role config. If i put in the setup roles/group-alias in the field the right policy gets applied as expected.

Expected behavior: vault looks at the roles/group-alias configuration, and any role/alias name that matches a group in the group claims applies the correct policy. If multiple policies are not available, it applies the first one that matches, and the admins need to ensure that users do not have more than one group that could match a vault config.

Start by tracing the OIDC browser login and the roles/group-alias handling, then inspect how the ID Token's groups claim is processed. Done means a matching group alias can select its policy without entering a role, with the documented first-match behavior when multiple aliases match.

Written by the indexing model from the issue text.