OIDC group claim → Project membership sync

[HarryKodden]

Summary

• Adds optional, default-off mapping from a configurable OIDC groups claim to SEEK Projects on login (Seek::Omniauth::OidcGroupProjectSync).
• Adds Admin/config setting omniauth_oidc_scope so group scopes (e.g. entitlement) can be requested without ENV hacks.
• Hardens OmniAuth login with remember-me + same-origin bounce after IdP return; documents setup in doc/oidc.md.

Behaviour (when enabled)

• New Project → user becomes project administrator
• Existing Project with no admins → user becomes project administrator
• Otherwise → normal member
• Membership is additive only (leaving an IdP group does not remove SEEK membership)

Not in this PR

• Local Docker overlays / Person auto-create (see docker-compose.override.yml.example on the branch for demos only)
• Group allowlist/prefix filter (deferred)

Test plan

• test/unit/omniauth/oidc_group_project_sync_test.rb
• test/integration/omniauth_test.rb (including groups sync on OIDC login)
• Manual: enable OIDC + groups in Admin, login with claim values, confirm Projects/memberships
• Confirm stock docker-compose.yml does not enable OIDC by default

Docs: doc/oidc.md

Made with Cursor

[Elwindb]

This would be a great fit with SURF's SRAM (SURF Research Access Management). I'd be happy to help with the PR