Support group assignment from token claims

As mentioned in #2205, it would be really great to automate granting privileges based on the contents of token claims. For any deployment spanning more than a handful of people it becomes cumbersome and a security problem waiting to happen to have to maintain privileges in multiple places.

Two separate problems exist here:

1. Reading token claims and assigning users to groups.
2. Updating (synchronizing) group assignments; i.e. if someone is added or removed from a group at the IdP level then it should be reflected in Outline.