chore(deps): upgrade itk-dev/openid-connect-bundle to 5.0

Bumps itk-dev/openid-connect-bundle (and upstream itk-dev/openid-connect)
from 4.x to 5.0. The 5.0 release reworks the exception hierarchy around a
marker interface: concrete exceptions no longer extend the now-deprecated
ItkOpenIdConnectException, so existing `catch (ItkOpenIdConnectException)`
blocks would silently match nothing.

Migrate the three OIDC catch sites in AuthOidcController and the one in
AzureOidcAuthenticator to catch OpenIdConnectExceptionInterface, the new
marker that both bundle- and library-thrown exceptions implement. Behaviour
(404 unknown provider, 500 OIDC failure, null end-session URL, wrapped auth
failure) is unchanged.

Add regression tests:
- AuthOidcControllerTest: the three getUrls() exception-mapping branches
  (null end-session URL, 404, 500) that the upgrade put at risk.
- AzureOidcAuthenticatorTest: the previously untested authenticate() logic
  — internal/external user provisioning, group-claim to tenant-role mapping,
  multi-role accumulation, tenant de-provisioning, and the
  unknown-suffix / missing-claim / unsupported-provider rejections.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: turegjorup

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- Upgraded `itk-dev/openid-connect-bundle` to 5.0 (and `itk-dev/openid-connect` to 5.0). Migrated the
+  OIDC exception catches in `AuthOidcController` and `AzureOidcAuthenticator` to the new
+  `OpenIdConnectExceptionInterface` marker, since concrete exceptions no longer extend the deprecated
+  `ItkOpenIdConnectException`. Added regression tests covering the exception-mapping branches and the
+  authenticator's claim-to-tenant-role provisioning and de-provisioning logic.
 - Removed the deprecated feed types `SparkleIOFeedType`, `EventDatabaseApiFeedType` and `KobaFeedType`.
   Made the unknown-feed-type handling consistent: **reads degrade, writes are rejected.** Feed sources
   (and feeds) that reference a removed type keep loading — item and collection reads return them with no

composer.json

@@ -21,7 +21,7 @@
         "doctrine/doctrine-migrations-bundle": "^3.1",
         "doctrine/orm": "^2.9",
         "gesdinet/jwt-refresh-token-bundle": "^1.0",
-        "itk-dev/openid-connect-bundle": "^4.1",
+        "itk-dev/openid-connect-bundle": "^5.0",
         "justinrainbow/json-schema": "^5.2",
         "kubawerlos/php-cs-fixer-custom-fixers": "^3.11",
         "lexik/jwt-authentication-bundle": "^2.14",