feat(oidc): OIDC Prompt (#4053)

Boundary OIDC method does not currently support passing in prompts during authentication. This change adds the capability of passing OIDC prompts. Prompts are optional OIDC parameters that determine the behaviour of the authentication server: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

## Changes

- New `auth_oidc_prompt` table which contains all the prompts for OIDC auth method
- New `auth_oidc_prompt_enm` table which contains possible enum values for a prompt
  - Currently supported:
    - `none`: 
The Authorization Server MUST NOT display any authentication or consent user interface pages
    - `login`: The Authorization Server SHOULD prompt the End-User for reauthentication
    - `consent`: The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client
    - `select_account`: The Authorization Server SHOULD prompt the End-User to select a user account
- `oidc_auth_method_with_value_obj` view has been updated to return `prompt` value
- Add `prompt` option for OIDC auth method CLI create and update
- Pass configured prompt during OIDC authentication
- Add `prompt` API validation for create and update

internal/proto/controller/api/resources/authmethods/v1/auth_method.proto

@@ -264,6 +264,16 @@ message OidcAuthMethodAttributes {
     json_name = "dry_run",
     (custom_options.v1.generate_sdk_option) = true
   ]; // @gotags: `class:"public"`
+
+  // The prompts allowed for the auth method.
+  repeated string prompts = 140 [
+    json_name = "prompts",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.prompts"
+      that: "Prompts"
+    }
+  ]; // @gotags: `class:"public"`
 }
 
 // The structure of the OIDC authenticate start response, in the JSON object

internal/proto/controller/storage/auth/oidc/store/v1/oidc.proto

@@ -163,6 +163,17 @@ message AuthMethod {
     this: "AccountClaimMaps"
     that: "attributes.account_claim_maps"
   }];
+
+  // prompts are the optional prompts allowed for an oidc auth method.
+  // These value objects specify whether the authorization server prompts
+  // the end-user for reauthentication, account selection and consent.
+  // These are Value Objects that will be stored as Prompt messages,
+  // and are operatated on as a complete set.
+  // @inject_tag: `gorm:"-"`
+  repeated string prompts = 220 [(custom_options.v1.mask_mapping) = {
+    this: "Prompts"
+    that: "attributes.prompts"
+  }];
 }
 
 // Account represents an OIDC account
@@ -364,3 +375,17 @@ message ManagedGroupMemberAccount {
   // @inject_tag: `gorm:"primary_key"`
   string member_id = 30;
 }
+
+// Prompt entries are the prompts allowed for an oidc auth method.
+message Prompt {
+  // @inject_tag: `gorm:"primary_key"`
+  string oidc_method_id = 10;
+
+  // prompt_param is an enum from the auth_oidc_prompt_enm table
+  // @inject_tag: `gorm:"primary_key;column:prompt"`
+  string prompt_param = 20;
+
+  // The create_time is set by the database.
+  // @inject_tag: `gorm:"default:current_timestamp"`
+  timestamp.v1.Timestamp create_time = 30;
+}