Per-domain directories: the OIDC directory tests, rebuilt from the spec; SCIM's OIDC test runs (DIR-7, DIR-10, DIR-14, DIR-15, DIR-18, DIR-26, DIR-29, SCIM test 5)

directory_tests now runs a new oidc module in place of the removed one,
with Keycloak as example.org's own directory: first sign-in creates the
account with its name and group, an existing account is reused, a token
named as another user is refused, password sign-in is refused, forged
JWTs (HS256, unknown kid, another issuer, expired) are refused, an OIDC
address is a recipient only once an administrator creates it, and sync
can't pass a tenant's account limit. scim_oidc_tests, deferred until
this feature, passes.

tests/src/directory/mod.rs

@@ -7,6 +7,7 @@
 pub mod discovery;
 pub mod integration;
 pub mod ldap;
+pub mod oidc; // inbuxa: rebuilt from the per-domain directories spec
 #[cfg(feature = "sqlite")]
 pub mod per_domain; // inbuxa: per-domain directories
 #[cfg(feature = "sqlite")]
@@ -17,7 +18,6 @@ pub mod unavailable;
 #[tokio::test(flavor = "multi_thread")]
 pub async fn directory_tests() {
     ldap::test().await;
-    #[cfg(feature = "pending-rebuild")] // inbuxa: pending-rebuild, see docs/spec/features/
     oidc::test().await;
     unavailable::test().await;
     discovery::test().await;