support for OIDC implicit flow

[bgerrity]

Solution

Add configurable support for the OIDC Implicit Flow. The draft PR #1879 has a work-in-progress changeset.

Describe alternatives you've considered

Not supporting the implicit flow

Use of the OIDC Implicit Flow is discouraged by the standards body and IAM providers. That said, some use cases may require it. The proposed change does not change the current behavior for the default OIDC Authorization Code Flow.

Additional context

The implementer's guide is the principal reference. Okta also provides an illustrative guide.