OIDC authentication pipeline - allow adding extra steps to the default pipeline

[marius-mather]

cc @nuwang

I previously added an option to override the entire authentication pipeline (which is useful for testing). However, for preserving the default pipeline but adding some extra processing, it may be better (and easier to maintain) to just configure additional steps that happen after the default pipeline.

I've added a config option oidc_auth_pipeline_extra to the galaxy.yml schema to support this.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[nuwang]

This looks good to me - we are more likely to need to add stuff after decoding the access token.