🐛(backend) allow all printable ASCII in the user sub field

The user `sub` field was rejecting some ASCII characters that are
actually valid according to the OIDC spec.

Loosen the validation to accept the full ASCII range except control
characters, so the field is compliant with the RFC and works with
any spec-compliant identity provider.

Based on the Stack Overflow discussion in question 279832.

Closes #1609.

src/backend/core/validators.py

@@ -0,0 +1,23 @@
+"""Custom validators for the core app."""
+
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext_lazy as _
+
+
+def sub_validator(value):
+    """Validate that the sub is printable ASCII only.
+
+    OpenID Connect Core 1.0 (section 2) allows any ASCII (RFC 20) string of
+    at most 255 characters, so no character whitelist is applied: providers
+    legitimately emit "|" (Auth0), ":" (Keycloak), "=", "/", etc. As a
+    deliberate hardening beyond the spec, ASCII control characters
+    (U+0000-U+001F and U+007F) are rejected: no known provider emits them,
+    NUL cannot be stored in PostgreSQL text fields, and the others invite
+    log-injection and interoperability issues. For str values,
+    ``isprintable()`` is false exactly for those control characters, while
+    space (U+0020) remains allowed.
+    """
+    if not value.isascii() or not value.isprintable():
+        raise ValidationError(
+            _("Enter a valid sub. This value should be printable ASCII only.")
+        )