Allow any ID token claim to be used as pivot attribute
See #2701 (closed)
@guimard I had to slightly change OIDC backchannel to match incoming sub
against a dedicated session attribute because _user
is no longer always equal to OP sub
when this new option is used.