Authentik support

[maikschneider]

This PR adds a ResourceResolver and ResourceProvider for the Identity Provider authentik.

• New TokenBasedResourceOwnerDetailsTrait: Omit the Userinfo request by decoding the AccessToken for user data
  • The authentik service needs to be configured to "Include claims in id_token" (see Advanced protocol settings in provider config)
• New SubResourceOwnerIdTrait: Some provider do not align with the default id offset, but use sub
  • MicrosoftResourceProvider now uses this trait as well
• The AuthentikResourceResolver implements the ProfileImageResolverInterface which assumes the image to be base64-encoded in the avatar offset
• No group support yet