Add openid connect support

Add minor changes to the code to support the apache module
mod_auth_openidc (https://github.com/pingidentity/mod_auth_openidc)

Also add documention on how to setup mod_auth_openidc for
SP federation.

implements: bp openid-connect

Change-Id: Ia48e94905de0a9ee0e3c8d4f007075cba6e7e770
Additional debug logs for federation flows

Adds debug logging for federation flows, specifically around the
mapping functions.

Change-Id: I40ed26173937d2b6b74f6228cf8e61373ea88b86
Closes-Bug: #1389586
Improve testing of domain federation tokens for inherited roles.

Currently domain-scoped federation-generated tokens incorrectly
include group roles that are inherited projects within that domain.
This error is also exposed via the /auth/domains and
/OS-FEDERATION/domains API calls.

This patch enhances our testing to demonstrate the error - a follow-on
patch will fix it.

Partially implements: bug 1385533
Partially implements: bug 1385643

Change-Id: I54d1d1a38cb63208c626efa5e4ca4a69e1b234a1
Merge "Add openid connect support"
Merge "Additional debug logs for federation flows"
Merge "Improve testing of domain federation tokens for inherited roles."