add OIDCOAuthenticator

[minrk]

generally only needs one configuration value: openid_provider_url

OIDCOAuthenticator is basically the same as base/generic OAuthenticator, but loads authorization/token/userinfo/jwks from openid configuration instead of requiring user config.

This adds jwks config options and jwt signature verification to the base class, but which remain disabled (unchanged) if unset.

closes #254

TODO:

• more testing
• docs
• consider basing several of our actually-OIDC Authenticator classes on this instead of the base (auth0, github, google, AzureAD))

[minrk]

I think this is ready to go. I don't think we need to shift existing classes to be based on OIDC yet, but we can explore that in the future as standalone changes.

[manics]

Tested with Keycloak, seems to work!

c.JupyterHub.authenticator_class = "oidc"
c.OAuthenticator.oauth_callback_url = "http://localhost:8000/hub/oauth_callback"
c.OAuthenticator.client_id = "jupyterhub"
c.OAuthenticator.client_secret = "<SECRET>"
c.OIDCOAuthenticator.openid_provider_url = "http://192.168.X.X:8080/realms/master"
c.OIDCOAuthenticator.scope = ["openid", "jupyterhub-roles"]
c.OIDCOAuthenticator.login_service = "keycloak"
c.OIDCOAuthenticator.username_claim = "preferred_username"
c.OIDCOAuthenticator.userdata_params = {"state": "state"}
c.OIDCOAuthenticator.auth_state_groups_key = "oauth_user.jupyterhub.roles"
c.OIDCOAuthenticator.manage_groups = True
c.OIDCOAuthenticator.allowed_groups = ["jupyterhub-users"]
c.OIDCOAuthenticator.admin_groups = ["jupyterhub-admins"]