Menshen is La Suite's OAuth 2.0 token exchange server (RFC 8693): another
service exchanges its user's access token for a token targeting Meet, then
calls the external API on behalf of that user. Tokens are validated by
introspection (RFC 7662). Menshen only reports a token as active when Meet
is among its audiences.
Add Menshen auth to the external API. Only activate it for room creation
scope (other scopes may be added later). If a user doesn't exist for the
provided sub, create it, unless the provided email is already associated
to a an existing account.
This PR does not implement fallback to email to automatically create
user when no sub or an invalid sub is passed and email is provided, when
OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION=True.
The user `sub` field was rejecting some ASCII characters that are
actually valid according to the OIDC spec.
Loosen the validation to accept the full ASCII range except control
characters, so the field is compliant with the RFC and works with
any spec-compliant identity provider.
Based on the Stack Overflow discussion in question 279832.
Closes#1609.
leo