Add optional OIDC avatar fetching from the picture claim

[rubentalstra]

This update enables BookStack to optionally fetch user avatars from the OIDC picture claim. The implementation:

1. Introduces a fetch_avatars config flag in config/oidc.php to toggle avatar retrieval.
2. Uses UserAvatars->assignToUserFromUrl($user, $picture, $accessToken) to support both public and private (Bearer token-protected) endpoints.
3. Fetches the picture claim from the user’s ID token or userinfo response, if provided.
4. Works with various OIDC providers (Google, Okta, Keycloak, Azure, etc.), provided they include or allow retrieving a valid picture URL.
5. Includes SSRF protection notes, advising users to only enable this if they trust the domains in the picture field.

This approach does not break existing behavior; avatar fetching is off by default. If enabled, BookStack will try to update a user’s avatar upon login, using the token to authenticate if necessary.