feat: support transfer_sub in apple id tokens (#2162)

Gain access to the [`transfer_sub` claim present in Apple ID
tokens](https://developer.apple.com/documentation/signinwithapple/bringing-new-apps-and-users-into-your-team)
when an app is being transferred from one owner to another (e.g. when an
app is purchased by another company).

Author: hf

internal/api/provider/oidc.go

@@ -170,6 +170,8 @@ type AppleIDTokenClaims struct {
 
 	AuthTime       *float64        `json:"auth_time"`
 	IsPrivateEmail *IsPrivateEmail `json:"is_private_email"`
+
+	TransferSub string `json:"transfer_sub"`
 }
 
 func parseAppleIDToken(token *oidc.IDToken) (*oidc.IDToken, *UserProvidedData, error) {
@@ -201,6 +203,10 @@ func parseAppleIDToken(token *oidc.IDToken) (*oidc.IDToken, *UserProvidedData, e
 		data.Metadata.CustomClaims["auth_time"] = *claims.AuthTime
 	}
 
+	if claims.TransferSub != "" {
+		data.Metadata.CustomClaims["transfer_sub"] = claims.TransferSub
+	}
+
 	if len(data.Metadata.CustomClaims) < 1 {
 		data.Metadata.CustomClaims = nil
 	}