Expanding on the ideas in #47

Some IDPs, such as Auth0, prevent you from adding the groups claim to the token. It'd be great if we can customize the claim that contains the groups

i.e.:

operator oidc:opkssh_groups:group-a https://accounts.google.com