feat: add group allowlist for oidc (#11070)

* feat: group allow list in OIDC settings

cli/testdata/coder_server_--help.golden

@@ -333,6 +333,12 @@ OIDC OPTIONS:
       --oidc-allow-signups bool, $CODER_OIDC_ALLOW_SIGNUPS (default: true)
           Whether new users can sign up with OIDC.
 
+      --oidc-allowed-groups string-array, $CODER_OIDC_ALLOWED_GROUPS
+          If provided any group name not in the list will not be allowed to
+          authenticate. This allows for restricting access to a specific set of
+          groups. This filter is applied after the group mapping and before the
+          regex filter.
+
       --oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
           OIDC auth URL parameters to pass to the upstream provider.
 

cli/testdata/server-config.yaml.golden

@@ -323,6 +323,11 @@ oidc:
   # mapping.
   # (default: .*, type: regexp)
   groupRegexFilter: .*
+  # If provided any group name not in the list will not be allowed to authenticate.
+  # This allows for restricting access to a specific set of groups. This filter is
+  # applied after the group mapping and before the regex filter.
+  # (default: <unset>, type: string-array)
+  groupAllowed: []
   # This field must be set if using the user roles sync feature. Set this to the
   # name of the claim used to store the user's role. The roles should be sent as an
   # array of strings.