chore: prevent authentication of non-unique oidc subjects (#16498)

Any IdP returning an empty field here breaks the assumption of a
unique subject id. This is defined in the OIDC spec.

coderd/users_test.go

@@ -831,6 +831,7 @@ func TestPostUsers(t *testing.T) {
 		// Try to log in with OIDC.
 		userClient, _ := fake.Login(t, client, jwt.MapClaims{
 			"email": email,
+			"sub":   uuid.NewString(),
 		})
 
 		found, err := userClient.User(ctx, "me")