Add groups to ID Token claims

[praseodym]

We need groups as one of the ID Token claims to support Kubernetes RBAC with OIDC Token authentication.

Probably requires our own OIDCTokenService which can be based on the DefaultOIDCTokenService, or overriding the ConnectTokenEnhancer.