User should be matched by "sub" claim when logging in with external OIDC provider.

[j-chmielewski]

Currently when the user is logging in using external oidc provider, he's matched against defguard database by email from oidc token email claim. There are 2 issues with this:

1. The email may change in defguard or external provider
2. There is no guarantee that the email is unique in the provider system

To fix this, the user should be matched against the sub claim which is guaranteed to be unique across the system.