feat: add generic OpenID Connect provider

[atymic]

Ports the provider from SocialiteProviders/Providers#1447 (thanks @adrum) into its own repo, so protocol and security fixes can release on their own cadence.

On top of the port:

• Multi-issuer support. Each connection in config/oidc.php registers as its own driver (oidc_keycloak, oidc_entra, ...) with isolated config and caches. A plain services.openidconnect block still works for a single IdP.
• Per-IdP provider classes (entra, keycloak, auth0, okta, google) that derive config from friendlier keys (tenant, realm, domain). Any Provider subclass can be named in config the same way.
• Pluggable issuer validation. EntraIssuerValidator fixes the multi-tenant {tenantid} issuer mismatch reported on the original PR.
• 153 tests, CI on PHP 8.2-8.4 including a lowest-deps run.

Docs are in the README plus docs/ for extending, the logout flows and the security model.

[kohenkatz]

This looks great, thank you for working on it!

One interesting issue I found with the Entra provider, based on my continued testing of the other PR:

Unlike other providers where the email claim returns the actual username that the user would use to log in, Entra returns the email address that is set in the user's contact information, which can be entirely unrelated to the account, and is often left empty. Microsoft instead uses a field called preferred_username to return the user's login email address.

I wonder if the Entra provider should use this field name, or if the general email field name should be configurable. Or perhaps an array of fields, and choose the first one that exists?

(I know that the consuming application can check the raw user data for this other field name, but it seems a shame to not be able to use the built-in functionality when the only difference is in the name.)

[adrum]

Did an analysis of my other branch and found these discrepancies

[adrum]

return (int) ($this->getConfig('cache_ttl') ?: 3600);

Two separate collapses land on this line. ConfigTrait::getConfig() returns the default whenever the stored value is empty(), so 0, '0' and '' all arrive as null; the ?: then folds anything falsy into 3600 again. Setting cache_ttl to 0 to turn caching off while debugging an IdP still caches the discovery document and JWKS for an hour.

The fix is the helper this file already has — rawConfig() at line 111, which logoutTokenReplayTtl() already uses for exactly this reason:

protected function getCacheTtl(): int
{
    $ttl = $this->rawConfig('cache_ttl');

    return ($ttl === null || $ttl === '') ? 3600 : (int) $ttl;
}

Treating '' as absent matters because an unset environment variable reads as '', which is absence rather than a deliberate 0. Worth applying the same !== '' guard at line 1128 in logoutTokenReplayTtl() for consistency.

[atymic]

Fixed, thanks!

[atymic]

Thanks for the cross-check, all four were real. Fixed in ccd8f59, including the nonce rename as one commit with the tests.

Went back over the rest with fresh eyes after this and found a few more in b98628e. Main one is key rotation for tokens with no kid header, which is optional in RFC 7517, so single-key OPs were failing every login after a rotation. It tries each key in the set now, since php-jwt bails on an empty kid before it even tries one. Also at_hash silently skipped for EdDSA (substr($alg, -3) gives "DSA"), a null discovery doc surfacing as a TypeError, and the http timeouts having the same falsy problem as cache_ttl.

199 tests. If your analysis turned up anything else, send it through :)