Add OAuth2 Authentication with OIDC Discovery Support

[christophmatt]

Is your feature request related to a problem? Please describe.
No.

Describe the solution you'd like
Introduce OAuth2-based authentication with integrated OpenID Connect (OIDC) discovery support.

The system should allow users to authenticate via external OAuth2/OIDC identity providers (IdP).
OIDC discovery should automatically resolve required endpoints (authorization endpoint, token endpoint, userinfo endpoint, JWKS URI, etc.) via the standard /.well-known/openid-configuration mechanism.

The goal is to:

• Enable login via OAuth2 providers
• Automatically configure endpoint paths using OIDC discovery
• Reduce manual configuration effort
• Support common providers (e.g., self-hosted IdPs, enterprise SSO setups)

Describe alternatives you've considered

• Manual configuration of OAuth2 endpoints without OIDC discovery (rejected due to configuration complexity and higher error risk).
• Supporting OAuth2 without OIDC (rejected because identity metadata and standardized discovery are required for maintainability and interoperability).

Additional context
This feature combines two aspects:

1. OAuth2 login support
2. Automatic endpoint detection via OIDC discovery

The implementation should allow flexible provider configuration and support multiple identity providers.

Optional considerations:

• Support for PKCE (Proof Key for Code Exchange)
• Role/claim mapping from ID token
• Configurable scopes
• Secure storage of tokens