Nested SSO support

[rentallect]

Explore the possibility of reusing the same JWT bearer token ZBR received from the IdP to authenticate onto the Ziti network as also the bearer token used to authenticate/login to a protected web app that supports federated login from the same IdP (e.g. Mattermost web app and 'login with Google')

[canny]

This issue has been linked to a Canny post: Add nested SSO support 🎉

[rickwang7712]

Hi @rentallect ,
I implemented nested sso by avoiding code grant parameters being captured by Browzer.
Below please check my implementations:

1. ziti-browzer-bootstrapper: add rp's callback path whitelist.
2. ziti-browzer-sw: only consumes code grant params if the path wasn't set as rp's callback path

If my modifications look good to you, please let me know, and I will send the pull requests.

Thanks!