release-26.1: oidcccl,provisioning: add user provisioning for OIDC authentication

[souravcrl]

Backport 1/1 commits from #159787 on behalf of @souravcrl.

---

Previously, the OIDC authentication flow in the DB Console only supported logging in with existing user accounts. There was no built-in mechanism to automatically create a new database user when a user authenticated via an OIDC provider for the first time.

This was inadequate because administrators would need to manually create a database user for every first‑time OIDC login, adding friction and overhead to onboarding.

To address this, this patch introduces automatic user provisioning for the OIDC authentication flow. When a new user successfully authenticates via an OIDC provider, a corresponding CockroachDB user is now automatically created if one does not already exist. This functionality is controlled by a new cluster setting, security.provisioning.oidc.enabled, which is disabled by default to maintain backward compatibility and ensure administrators can opt-in to this behavior.

Note: The security.provisioning.oidc.enabled cluster setting requires checking user existence before provisioning. This may introduce latency when concurrent OIDC authentication attempts from browsers generate high read request load on the user table.

Fixes: #126680
Epic: CRDB-48764

Release note (enterprise change): A new cluster setting, security.provisioning.oidc.enabled, has been added to allow for the automatic provisioning of users when they log in for the first time via OIDC. When enabled, a new user will be created in CockroachDB upon their first successful OIDC authentication. This feature is disabled by default.

On enabling the setting, user gets created on oidc login and can be validated using the SHOW users command.

   > SELECT * FROM [SHOW USERS] WHERE username = 'testuser';

       username    |                     options                     | member_of | estimated_last_login_time
  -----------------+-------------------------------------------------+-----------+----------------------------
    testuser       | {PROVISIONSRC=oidc:https://accounts.google.com} | {}        | NULL
  (1 row)

  NOTICE: estimated_last_login_time is computed on a best effort basis; it is not guaranteed to capture every login event

---

Release justification: oidc user provisioning is needed for authZ.

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that the change does not break backwards compatibility and otherwise complies with the backport policy. Include a brief release justification in the PR description explaining why the backport is appropriate. All backports must be reviewed by the TL for the owning area. While the stricter LTS policy does not yet apply, please exercise judgment and consider gating non-critical changes behind a disabled-by-default feature flag when appropriate.

[cockroach-teamcity]

This change is