Self-serve SSO for OIDC

Workspace admins connect an OIDC identity provider without contacting support.