generic OIDC integration for services lacking OIDC integration

We have some applications that don't have native support for OIDC (e.g. Thanos, see #1278)

For those, we could integrate in Sylva a solution like oauth2-proxy (or an alternative).

/cc @alain.thioliere @pseite @mihai.zaharia @stoub