feat: synchronize oidc user roles (#8595)

* feat: oidc user role sync
User roles come from oidc claims. Prevent manual user role changes
if set.
* allow mapping 1:many

enterprise/coderd/coderd_test.go

@@ -56,6 +56,7 @@ func TestEntitlements(t *testing.T) {
 				codersdk.FeatureExternalProvisionerDaemons: 1,
 				codersdk.FeatureAdvancedTemplateScheduling: 1,
 				codersdk.FeatureWorkspaceProxy:             1,
+				codersdk.FeatureUserRoleManagement:         1,
 			},
 			GraceAt: time.Now().Add(59 * 24 * time.Hour),
 		})