feat: link oidc credentials when login

[splaunov]

When user tries to login with OIDC for the first time but has already registered before with email/password a credentials identifier conflict may be detected by Kratos. In this case user needs to login with email/password first and then link OIDC credentials on a settings screen.
This PR simplifies UX and allows user to link OIDC credentials to existing account right in the login flow, without
switching to settings flow.

Related issue(s)

#2727

Checklist

• [ x] I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• [ x] I am following the
  contributing code guidelines.
• [ x] I have read the security policy.
• [ x] I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  security@ory.sh) from the maintainers to push
  the changes.
• [ x] I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

[aeneasr]

Thank you! Unfortunately, merging this would introduce some quite serious security vulnerabilities which allows account take over:

1. Adam signs up with adam@example.org in Kratos
2. Eve creates account at e.g. Twitter with adam@example.org
3. Eve uses Twitter account to sign into Kratos, system things it's adam@example.org
4. Account is taken over

There are some ways to prevent this problem by, for example, requiring email verification but not all services support returning these fields.

Emails, in general, can not be used to cross reference authentication between completely separate systems.

To improve UX, the best way would be:

1. Sign up with adam@example.org and password
2. Adam tries to sign in with Google account adam@example.org
3. UI says: "You already have an account. Please sign in with your password, and link your Google account in the next step"

[splaunov]

3. Eve uses Twitter account to sign into Kratos, system things it's adam@example.org
4. Account is taken over

Eve will be requested to login with email/password first. So, takeover is not possible.
Security-vice it's the same flow as already implemented in kratos. The only difference is that the settings UI is skipped. Credentials are auto-merged if user logins with both credentials.

[aeneasr]

I see! My bad, in that case, this looks like a very nice approach :) I'll try to get it running in the next couple of days locally

[hperl]

Thank you for your contribution! I merged the latest changes into your branch and opened a new PR here: #3563. I'll finish off the PR there.

[aeneasr]

@splaunov thank you so much for this work! @hperl has done an amazing job of iterating over your work and we are happy to announce that the feature has landed on master!