feat: implement package and cli tool for repairing oidc links (#26418)

cli/testdata/coder_server_--help.golden

@@ -9,6 +9,9 @@ SUBCOMMANDS:
     create-admin-user           Create a new admin user with the given username,
                                 email and password and adds it to every
                                 organization.
+    fix-oidc-links              Reset OIDC linked IDs that do not match the
+                                expected issuer, allowing users to
+                                re-authenticate.
     postgres-builtin-serve      Run the built-in PostgreSQL deployment.
     postgres-builtin-url        Output the connection URL for the built-in
                                 PostgreSQL deployment.

cli/testdata/coder_server_fix-oidc-links_--help.golden

@@ -0,0 +1,29 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder server fix-oidc-links [flags]
+
+  Reset OIDC linked IDs that do not match the expected issuer, allowing users to
+  re-authenticate.
+
+OPTIONS:
+      --postgres-connection-auth password|awsiamrds, $CODER_PG_CONNECTION_AUTH (default: password)
+          Type of auth to use when connecting to postgres.
+
+  -n, --dry-run bool, $CODER_FIX_OIDC_LINKS_DRY_RUN
+          Print analysis only, do not modify the database.
+
+      --issuer-url string, $CODER_OIDC_ISSUER_URL
+          The OIDC issuer URL. The canonical issuer is resolved via OIDC
+          discovery.
+
+      --postgres-url string, $CODER_PG_CONNECTION_URL
+          URL of a PostgreSQL database. If empty, the built-in PostgreSQL
+          deployment will be used (Coder must not be already running in this
+          case).
+
+  -y, --yes bool
+          Bypass confirmation prompts.
+
+———
+Run `coder --help` for a list of global options.