Custom OIDC shouldn't use the logged in OIDC user's `email` claim as the identity of the user

### What is the issue?

When signing up with a custom OIDC provider, we're asked to provide an "email", from which the host to send the webfinger query to is derived. If we provide `mike@my-oidc-domain.com`, we lookup the webfinger at `my-oidc-domain.com` for the resource `acct:mike@my-oidc-domain.com`. Note however, that there's no part of WebFinger RFC or the `acct` scheme RFC that requires the semantics of the `acct` resource be "email address". Editing this here to point out there's even a discussion in [the `acct` RFC](https://datatracker.ietf.org/doc/html/rfc7565#section-4) about the interaction with email.

Yet when we proceed with the signup, Tailscale forces the OIDC identity token it receives for the logged in user to have an `email` that's equal to this `acct` resource. If I have instead the email `mike@email-domain.com` I see:

> The user returned from the authentication process (mike@email-domain.com) does not match the user provided at login (mike@my-oidc-domain.com). You may need to log out from your identity provider in order to switch users. Try again or [contact support](https://tailscale.com/contact/support/#contact-support-root).

Why? Where does an email address come into play here?

Users on my OIDC provider can have arbitrary email addresses, after all an email address is just a place to send communications, not an identity. The identity is _defined by the OIDC subject_.

Hence, according to the OIDC spec, the relying party also MUST NOT depend on `email` being unique. Granted I suppose this depends on how exactly Tailscale is using this identifier, but doesn't Tailscale indeed want a unique identifier for the user at this issuer? Is this not a problem?

In particular, this means I can never change my email address on my OIDC! Otherwise I can no longer log into my account again, I get the same error.

I suppose the idea of WebFinger is to get a "nice" name for your tailnet? Where if I can show that I own `domain.com`, Tailscale will let me call my tailnet `domain.com`, even if my IdP is `some-other-domain.com`. For this purpose, perhaps instead of email `preferred_username` should have been used. So given the initial fake "email" `mike@domain.com`, Tailscale verifies `preferred_username` == `mike` in the ID token. `preferred_username` is just as invalid as `email` for an identity because it also might not be unique, but at least it doesn't require such a drastic constraint on how the IdP handles email addresses. The _correct_ way to do this is of course to use `sub` but a lot of the time this is just a meaningless number.

### Steps to reproduce

Try to sign up with custom OIDC with a user whose email is not under control of the OIDC issuer.

### Are there any recent changes that introduced the issue?

_No response_

### OS

_No response_

### OS version

_No response_

### Tailscale version

_No response_

### Other software

_No response_

### Bug report

_No response_