Draft: add OpenID Connect support

• I agree to release my code and all other changes of this MR under the Apache-2.0 license

Things to do:

• MR working with keycloak
• random state
• use sub as a new field in the database
• replace unwrap()

Later:

• handle tokens expiration and renew
• be able to customize redirect_url /sso_return
• backchannel logout
• nonce