Feature request: Support custom query parameters in OIDC authorize URL (auth_url_params)

**Problem:**

When using the OIDC auth method with Auth0 as the provider, there's no way to pass custom query parameters (like organization) to the /authorize URL that Vault constructs.

Auth0's multi-tenant organizations feature requires the organization parameter in the authorize request when organization_usage is set to require. Without it, Auth0 rejects the request with:

error=invalid_request&error_description=parameter organization is required for this client
Current Behavior

The OIDC role accepts an auth_url_params field in the API request body without error, but silently ignores it — the parameter is never persisted or included in the generated authorize URL.

Tested on Vault 1.16.1 and 1.17.2 — both exhibit the same behavior.

**Expected Behavior:**

An auth_url_params field on the OIDC role (map of string to string) that appends arbitrary query parameters to the authorize URL. For example:

{
"auth_url_params": {
"organization": "org_abc123"
}
}

**Would produce:**

https://provider.com/authorize?client_id=...&organization=org_abc123&...

**Use Case:**

Auth0 Organizations (multi-tenant apps)
Forcing a specific connection (skip IdP selection)
Passing login_hint for pre-filled email
Any OIDC provider that requires custom authorize parameters
Workaround

Currently the only workaround is to set organization_usage: "allow" on the Auth0 application, which weakens the security posture by not enforcing organization membership at the IdP level.

**Environment:**

Vault 1.17.2
vault-plugin-auth-jwt (built-in)
Auth0 as OIDC provider

The issue names no files or tests. Start by tracing the OIDC role schema and persistence, then follow authorize URL generation; verify that auth_url_params survives role writes and is reflected in the generated URL, including the Auth0 organization example.

Written by the indexing model from the issue text.