Use scopes from provider for OIDC token generation if present

[jeremydonahue]

This allows the provider to specify custom scopes that should be used when generating OIDC tokens. This is useful when, for example, when using the OIDC provider with Dex and Github in that it allows the preferred_username or federated_claims.user_id fields to be returned with the token for use in SSH certificate templates (ie. to identify a Github user via extensions:login@github.com).

Note that this feature depends on smallstep/certificates#1796 being merged to provide the Scopes field on providers.OIDC.

Example usage:
ca.json:

{
    "type": "OIDC",
    ...
    "scopes": ["openid","email","profile","federated:id"]
}

SSH template:

	"extensions": {
	  "id@github.com": {{ toJson .Token.federated_claims.user_id }}
	}

Name of feature:

Custom scopes for OIDC providers.

Pain or issue this feature alleviates:

Same as smallstep/certificates#1796.

Why is this important to the project (if not answered above):

Same as smallstep/certificates#1796.

Is there documentation on how to use this feature? If so, where?

Same as smallstep/certificates#1796.

In what environments or workflows is this feature supported?

Same as smallstep/certificates#1796.

In what environments or workflows is this feature explicitly NOT supported (if any)?

Same as smallstep/certificates#1796.

Supporting links/other PRs/issues:

Requires smallstep/certificates#1796.

[maraino]

See my comment on smallstep/certificates#1796