Add an OpenID Connect authentication realm

[jkakavas]

This commit adds an OpenID Connect authentication realm to
elasticsearch. Elasticsearch (with the assistance of kibana or
another web component) acts as an OpenID Connect Relying
Party and supports the Authorization Code Grant and Implicit
flows as described in http://ela.st/oidc-spec. It adds support
for consuming and verifying signed ID Tokens, both RP
initiated and 3rd party initiated single sign on and RP
initiated signle logout.
It also adds an OpenID Connect Provider in the idp-fixture to
be used for the associated integration tests.

Documentation will be added in a separate PR as it is not
yet reviewed.
The code in this commit has been tracked in a feature branch
and has been previously reviewed and approved in :

#37009
#37787
#38474
#38475
#40262

[jaymode]

Feature branch merges like this one where all of the individual changes have been reviewed, should be ok to merge if CI is happy and there haven't been non trivial changes. That said, @tvernum did find some things that were missed by myself and Albert, so maybe having a "skimmed" review would be worth it prior to merging.

[tvernum]

I don't know what's the best option is for when merging feature branches.

The key question that needs to be answered at this point is "does the sum of the parts equal a production ready feature".

It's entirely possible that every PR that lead to this point was fine, but the final result is missing something important that means it shouldn't be merged.

It's still a perfectly reasonable opportunity to double check parts that had previously been reviewed, and raise concerns that we missed on the first round, but we're mostly looking for What haven't we done.

How we do that is a separate question, and I think probably better discussed face-to-face.
It's tricky, because in an ideal world, a feature branch would have contribution from many people, and a mix of reviewers, so there's not going to be anyone who is knowledgeable enough about the work to review it well, but independent from the implementation. In those cases, our starting point should be that the team that worked on it are the joint approvers - the question is does the team think this is ready to ship?

[tvernum]

I'm happy to the extent that I can reasonably review this.

It has tests, feature licensing seems to be correct, dependencies seem to be OK.
I'm happy to rely on the previous reviews having picked up the lower level implementation details.

[bizybot]

LGTM, Thank you.

[albertzaharovits]

LGTM.