Restrict account creation based on OIDC `groups` claim

Hi,

I'm looking to set up Outline as an internal wiki system for my company. We need to restrict access to the system to a subset of our employees, so a purely domain-based approach won't work for us. Conveniently we have an OIDC group that we can use to give access. I'm thinking that a minimal approach would be to:

1. Add an environment variable, OIDC_REQUIRE_GROUP, which can be set to the group that must be claimed by the OIDC token on user account creation.
2. Extend the existing OIDC flow to extract the groups claim and check if the required group is present there.
3. If not, throw an auth error; otherwise, proceed.

This mirrors the approach for domain-based filtering. Is this something you would consider? I'm happy to write it up and submit a PR if so.