fix(nextcloud): make the sociallogin OIDC account an administrator

Nextcloud#1 of run 33923190220 fails two admin surfaces:
addons/whiteboard.spec.js:28 waiting for the settings/admin/whiteboard shell
and addons/integration_openai.spec.js:32 waiting for #openai_prefs on
settings/admin/ai. Both time out with "element(s) not found" after two
retries.

The cause is not the apps. In the sociallogin flavor the Keycloak login
provisions a second Nextcloud account whose uid is <provider>-<keycloak sub>,
while the role only ever puts the local administrator account into the admin
group, so the browser session that the specs drive is an ordinary user and
every /settings/admin/* route renders nothing. sso_oidc_plugin.py returns
"oidc_login" if ldap_enabled else "sociallogin", so this only bites where LDAP
is off: variants on oidc_login with oidc_login_proxy_ldap land on the
LDAP-backed account that 07_admin_identities.yml adds to admin instead.

The provider asked for scope "openid" with an empty groupsClaim, so no group
information reached the plugin at all and no mapping could have worked. It now
requests the RBAC scope, reads the claim, and maps the application's
administrator group onto Nextcloud's built-in admin group.

Every link is in place already. RBAC.GROUP.CLAIM is "groups", the Keycloak
client scope carries the same name and sits in defaultClientScopes, and its
mapper sets full.path true, so the claim carries /roles/<app>/<role> and the
leading slash in the mapping key matches. rbac_group_path accepts
'administrator' without a declaration because it is the implicit admin role,
and build_realm_rbac_groups adds that group to every RBAC application, so the
group the key names is really provisioned. Upstream reads both keys:
ProviderService maps groups_claim to groupsClaim and group_mapping to
groupMapping, and applies the mapping by group id.

Adminship is necessary for those two specs but may not be sufficient: both
assertions also claim their app is installed and enabled.

roles/web-app-nextcloud/meta/addons/sociallogin.yml

@@ -41,8 +41,10 @@ config:
             logoutUrl: "{{ OIDC.CLIENT.LOGOUT_URL }}"
             clientId: "{{ OIDC.CLIENT.ID }}"
             clientSecret: "{{ OIDC.CLIENT.SECRET }}"
-            scope: "openid"
-            groupsClaim: ""
+            scope: "openid {{ RBAC.GROUP.CLAIM }}"
+            groupsClaim: "{{ RBAC.GROUP.CLAIM }}"
+            groupMapping:
+              "/{{ lookup('rbac_group_path', application_id=application_id, role='administrator') }}": "admin"
             defaultGroup: ""
     - appid: "sociallogin"
       configkey: "disable_notify_admins"