feat: add support for groups when roles are missing

[vknabel]

Description

In practice not all OIDC providers expose roles. Some expose groups instead. We still prefer roles when possible, but fall back to groups. Alternatively a new type of user extractor would be required to be introduced, effectively requiring to add a new config field for iam tenant configs and still adding the same config field to the generic claims.

This should be not break any clients.

[Gerrit91]

This would only be breaking if there were tokens that contain both claims at the time being and then the new roles claim would overwrite the groups claim. But as far as I know there are no such tokens around.

[vknabel]

It could only break the current behavior, if roles would be empty in the token, and it would include groups with a group name in the correct format. Highly unlikely and would point to an error in the configuration of the OIDC provider itself.

[Gerrit91]

/cc @michaelottofits

[michaelottofits]

The authorization information in the token claims can be configured with the OIDC provider. It does not matter whether the claim is named roles or groups or whatever. I only see these requirements for OIDC providers that may not have such a standard configuration. I wouldn't change anything here