Connect an OpenID Connect identity provider for single sign-on

Refuses a domain whose `_cloady.<domain>` TXT record doesn't carry the workspace's `txtValue` yet, so a saved connection is always live. Anyone the provider signs in with an email at the domain joins the workspace as a developer. Omit `clientSecret` to keep the stored one. Requires admin.

curl -X PUT "https://example.com/api/workspaces/string/sso" \  -H "Content-Type: application/json" \  -d '{    "domain": "string",    "issuer": "http://example.com",    "clientId": "string"  }'

{  "sso": {    "domain": "string",    "issuer": "string",    "clientId": "string"  }}