OmniAuth Authorization API

WP [#13781](https://www.openproject.org/work_packages/13781)
Why do you pass the user filled with new data from the authentication provider? The new data might not be valid, so this might prevent changing the user (e.g. if we want to set an admin flag).