Adds OIDC/OAuth2 authorization-code SSO as a new authentication method (method_sso) for the CodeChecker web server and Vue UI.

[NikhilJeikar]

Backend

• New cc_sso.py module handles token exchange (/token), userinfo fetch (/userinfo), username claim resolution, and group parsing.
• New server routes:
  • GET /sso-login — starts the flow, stores OAuth state in DB, redirects to the IdP
  • GET /sso-callback — validates state, exchanges the IdP code, creates a privileged session, redirects to the SPA with a short-lived exchange code
• SessionManager gains SSO state/exchange-code helpers (reusing oauth_sessions), admin-group → SUPERUSER elevation, and dynamic get_enabled_auth_methods().
• performLogin("sso", ...) redeems the one-time exchange code and returns the session token to the SPA (session token is never placed in the URL).
• server_config.json adds method_sso with sso_server, client_id, client_secret, redirect_uri, admin_group, and optional username_claim.

Frontend

• SSO login button on the login page; auto-redirect when SSO is the only enabled method.
• New SSOLogin.vue callback route redeems the exchange code via Thrift and loads the logged-in user.
• Logout redirects back through SSO when it is the only auth method.

Security hardening (review follow-up)

• OAuth state parameter with DB-backed validation and one-time consumption
• One-time exchange codes (2 min TTL) instead of passing session tokens in query strings
• Aligned scopes (openid profile email) across authorize and token requests
• Robust error handling for missing parameters, IdP errors, and failed token exchange
• Username mapped from username_claim or standard OIDC claims (preferred_username → email → sub)

Authentication flow

User → GET /sso-login
     → IdP /authorize (with state)
     → GET /sso-callback?code=&state=
         → validate state
         → exchange code with IdP
         → fetch userinfo, map username & groups
         → create privileged session
         → redirect /sso-login-callback?code=<exchange_code>
     → SPA performLogin("sso", exchange_code)
     → session token saved → redirect to app