feat: support federated OIDC login through the OAuth2 Authorization Server (#24050)

[netroms]

Backport of #24050 to 2.43.
JIRA:DHIS2-21752

What

Fixes federated OIDC login through DHIS2's OAuth2 Authorization Server. After an external-IdP login ("Log in with Google"), reading the authorization at /oauth2/token returned HTTP 500, because the persisted principal (DhisOidcUser wrapping a UserDetailsImpl) is not on Spring Security's SecurityJackson2Modules deserialization allowlist.

The persistence layer now swaps the heavyweight DHIS2 principal for a lean, Spring-native UsernamePasswordAuthenticationToken (DHIS2 username + authorities) at the toEntity serialization boundary, so the persisted attributes round-trip with no custom Jackson mixins. This also fixes the federated flow end to end — the username/email claims previously carried the IdP sub.

Backport notes

• Cherry-picked cleanly from master (cd398b5); no code conflicts.
• UserDetailsImpl.java result is byte-identical to master's post-PR version.
• Spring Authorization Server on 2.43 is 1.5.2 (same as master); the token-context principal is built from the persisted Principal attribute, so the lean-principal approach is valid.
• Verified locally: mvn test-compile of dhis-service-core, dhis-test-integration, dhis-test-web-api → BUILD SUCCESS; all three backported tests compile (LeanPrincipalTest, Dhis2OAuth2AuthorizationServiceIntegrationTest, FederatedOidcTokenControllerTest).

Original PR: #24050

AI Assisted

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud