Dedicated API for extracting roles from Oidc User flow

Summary

Today, in order to extract Spring Security roles from custom role representations in the Oidc User flow, code needs to fall back to implementing an OAuth2UserService:

public MyRoleExtractingOidcUserService implements OAuth2UserService<OidcUserRequest, OidcUser> {
    private final OidcUserService delegate;

    // ...

    public OidcUser loadUser(OidcUserRequest request) {
        OidcUser user = delegate.loadUser(reqest);

        Collection<? extends GrantedAuthority> authorities = 
        // extract authorities using request and user objects

        return  new DefaultOidcUser(authorities, ...);
}

This follows from the reference documentation [1].

Would be nice to have a dedicated authorities extractor:

interface OAuth2UserAuthoritiesExtractor<R extends OAuth2UserRequest, U extends OAuth2User> {
    Collection<? extends GrantedAuthority> extractAuthorities(R request, U user);
}

[1] - https://docs.spring.io/spring-security/site/docs/5.0.5.RELEASE/reference/htmlsingle/#oauth2login-advanced-map-authorities-oauth2userservice

Additional Info

This is born out of some observations from @thomasdarimont in a OAuth github sample.

Start with the OAuth2UserService customization described in the linked reference documentation and inspect the OidcUser flow entry points in Spring Security. Define the dedicated authorities-extraction API proposed in the issue, then verify that custom OIDC role representations can be converted without requiring a replacement OAuth2UserService.