feat: add endpoint and CLI for users to view their own OIDC claims (#23053)

- Adds a new API endpoint `GET /api/v2/users/oidc-claims` that returns
only the **merged claims** (not the separate id_token/userinfo
breakdown). Scoped exclusively to the authenticated user's own identity
— no user parameter, so users cannot view each other's claims.
- Adds a new CLI command:** `coder users oidc-claims` that hits the
above endpoint.
- The existing owner-only debug endpoint is preserved unchanged for
admins who need the full claim breakdown.


> 🤖 This PR was created with the help of Coder Agents, and will be
reviewed by my human. 🧑‍💻

coderd/apidoc/swagger.json

@@ -6965,6 +6965,27 @@
 				]
 			}
 		},
+		"/users/oidc-claims": {
+			"get": {
+				"produces": ["application/json"],
+				"tags": ["Users"],
+				"summary": "Get OIDC claims for the authenticated user",
+				"operationId": "get-oidc-claims-for-the-authenticated-user",
+				"responses": {
+					"200": {
+						"description": "OK",
+						"schema": {
+							"$ref": "#/definitions/codersdk.OIDCClaimsResponse"
+						}
+					}
+				},
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				]
+			}
+		},
 		"/users/oidc/callback": {
 			"get": {
 				"tags": ["Users"],
@@ -15337,6 +15358,16 @@
 				}
 			}
 		},
+		"codersdk.OIDCClaimsResponse": {
+			"type": "object",
+			"properties": {
+				"claims": {
+					"description": "Claims are the merged claims from the OIDC provider. These\nare the union of the ID token claims and the userinfo claims,\nwhere userinfo claims take precedence on conflict.",
+					"type": "object",
+					"additionalProperties": true
+				}
+			}
+		},
 		"codersdk.OIDCConfig": {
 			"type": "object",
 			"properties": {