OpenID Connect authentication provider: verifies an identity provider's access token at the WebSocket handshake and maps its claims to a zeroz4j principal. Optional — depend on it only when the application authenticates against an OIDC provider such as Keycloak.