Add OIDC provider functionality with validation setup

This commit adds OpenID Connect (OIDC) provider functionality to tinyauth,
allowing it to act as an OIDC identity provider for other applications.

Features:
- OIDC discovery endpoint at /.well-known/openid-configuration
- Authorization endpoint for OAuth 2.0 authorization code flow
- Token endpoint for exchanging authorization codes for tokens
- ID token generation with JWT signing
- JWKS endpoint for public key distribution
- Support for PKCE (code challenge/verifier)
- Nonce validation for ID tokens
- Configurable OIDC clients with redirect URIs, scopes, and grant types

Validation:
- Docker Compose setup for local testing
- OIDC test client (oidc-whoami) with session management
- Nginx reverse proxy configuration
- DNS server (dnsmasq) for custom domain resolution
- Chrome launch script for easy testing

Configuration:
- OIDC configuration in config.yaml
- Example configuration in config.example.yaml
- Database migrations for OIDC client storage

config.example.yaml

@@ -63,6 +63,42 @@ oauth:
       # Allow insecure connections (self-signed certificates)
       insecure: false
 
+# OIDC Provider Configuration
+oidc:
+  # Enable OIDC provider functionality
+  enabled: false
+  # OIDC issuer URL (defaults to appUrl if not set)
+  issuer: ""
+  # Access token expiry in seconds (3600 = 1 hour)
+  accessTokenExpiry: 3600
+  # ID token expiry in seconds (3600 = 1 hour)
+  idTokenExpiry: 3600
+  # OIDC Client Configuration
+  clients:
+    # Client ID (used as the key)
+    myapp:
+      # Client secret (or use clientSecretFile)
+      clientSecret: "your_client_secret_here"
+      # Path to file containing client secret (optional, alternative to clientSecret)
+      clientSecretFile: ""
+      # Client name for display purposes
+      clientName: "My Application"
+      # Allowed redirect URIs
+      redirectUris:
+        - "https://myapp.example.com/callback"
+        - "http://localhost:3000/callback"
+      # Allowed grant types (defaults to ["authorization_code"] if not specified)
+      grantTypes:
+        - "authorization_code"
+      # Allowed response types (defaults to ["code"] if not specified)
+      responseTypes:
+        - "code"
+      # Allowed scopes (defaults to ["openid", "profile", "email"] if not specified)
+      scopes:
+        - "openid"
+        - "profile"
+        - "email"
+
 # UI Customization
 ui:
   # Custom title for login page