Per-domain directories: the OIDC directory tests, rebuilt from the spec; SCIM's OIDC test runs (DIR-7, DIR-10, DIR-14, DIR-15, DIR-18, DIR-26, DIR-29, SCIM test 5)

directory_tests now runs a new oidc module in place of the removed one,
with Keycloak as example.org's own directory: first sign-in creates the
account with its name and group, an existing account is reused, a token
named as another user is refused, password sign-in is refused, forged
JWTs (HS256, unknown kid, another issuer, expired) are refused, an OIDC
address is a recipient only once an administrator creates it, and sync
can't pass a tenant's account limit. scim_oidc_tests, deferred until
this feature, passes.

tests/src/scim/mod.rs

@@ -437,8 +437,9 @@ pub async fn scim_tests() {
     }
 }
 
-/// Acceptance test 5, deferred until per-domain directories (feature 9)
-/// are built: it binds an OIDC directory to one domain (SCIM-61 decision).
+/// Acceptance test 5: SCIM's authority over sign-in sync, with Keycloak as
+/// one domain's own directory (per-domain directories, feature 9).
+/// `cargo test -p tests scim_oidc_tests -- --ignored`.
 #[ignore]
 #[tokio::test(flavor = "multi_thread")]
 pub async fn scim_oidc_tests() {