The OIDC work needs to cache some information (at least, the JWKS keys)
so we don't ask for them over and over again needlessly. An in-process
cache is in theory fine, but using Plugin::Cache nicely gives us expiry
support which we need too (to catch key revocations).

The login code in doEmailLogin is treating email address & username as
the same concept, but it shouldn't be. Allow passing in a username field
explicitly to doEmailLogin to set as the user's username column.

The templates have also been changed to call a new usernameForDisplay
method which will be able to customise the display of the username in
circumstances where the username would look stupid (e.g. in the
forthcoming OIDC support)

OIDC providers are configured in the config file under <oidc> <provider
foobar>. There can be multiple providers, each one will get a menu item
in the dropdown to log in with.

After login is successful, we validate all the claims and then perform
doEmailLogin, creating the user if it did not exist.

If presented with a "hydra_roles" claim, we will set the user roles to
that claim.

fixup! Implement OIDC login

Sanitize 'after' parameter to prevent open redirect: //evil.com would
be interpreted as a protocol-relative URL by browsers.

fixup! Implement OIDC login

Use constant-time comparison for state and nonce to avoid timing
side-channels.

fixup! Implement OIDC login

- Reject token endpoint responses with HTTP error but no 'error' field
- Validate aud claim exists before dereferencing

fixup! Add mapping of OIDC claims to roles

Wrap setRoles INSERT+DELETE in a transaction so role updates are
atomic.

fixup! Implement OIDC login

Don't let an unreachable IdP prevent Hydra from starting. Log the
error and disable OIDC login instead of dying in setup_finalize.

fixup! Add test for OIDC implementation

Move test-only Perl modules (TestWWWMechanize, HTTPCookieJar, ...) from
the main hydra package to hydra-tests where they belong.

fixup! Implement OIDC login

Drop redundant base64URLEncode wrapper: MIME::Base64::encode_base64url
already strips '=' padding per RFC 4648 §5, so the s/=+$//r was a
no-op.

fixup! Implement OIDC login

Collapse 4x repeated config validation into a loop. Bonus: the error
now names which field is missing instead of listing all four.

fixup! Implement OIDC login

Let Crypt::JWT verify iss/aud/exp/nbf instead of reimplementing the
OIDC §3.1.3.7 checklist by hand. The library already handles the
array-or-scalar aud case and rejects alg=none. Keep only the
OIDC-specific nonce check and sub presence check.

fixup! Implement OIDC login

Drop Crypt::URandom::Token dependency (and its flake overlay).
base64url-encoding raw urandom bytes satisfies both RFC 6749
state/nonce and RFC 7636 PKCE verifier requirements without needing
a custom token-from-charset generator.

fixup! Implement OIDC login

Modernize with Perl 5.36+ features:
- Subroutine signatures replace 'my ($self, ...) = @_' boilerplate
- try/catch replaces eval/$@ (avoids the $@-clobbered-by-destructor
  footgun and gives a lexically-scoped error variable)
- Simplify scope construction with join+grep

fixup! Implement OIDC login

Make OIDC discovery lazy instead of blocking startup.

Previously resolveOIDCConfig did an HTTP GET to the discovery_url in
setup_finalize, meaning every Hydra start blocked on the IdP for up to
10s and an IdP that was down at boot left OIDC broken until restart.

Now resolveOIDCConfig only loads secrets from disk and validates static
config (no network). Discovery happens in _resolvedConf on the first
login attempt, cached for 1h via Plugin::Cache and also written back
into the in-process config so subsequent calls short-circuit. An IdP
outage now only affects users trying to log in (503), and recovers
automatically without a restart.

fixup! Add Kanidm to the Foreman configuration

Bump Kanidm startup timeout from 60s to 180s (overridable via
KANIDM_STARTUP_TIMEOUT) and dump the log tail on timeout. The 60s
limit was observed to be insufficient on loaded aarch64 GitHub CI
runners where tests run in parallel; and pointing at a log file
inside the sandbox is useless once the build fails.