Add support for multiple OpenID providers with role policies (#14223)

- When using multiple providers, claim-based providers are not allowed. All
providers must use role policies.

- Update markdown config to allow `details` HTML element

internal/config/identity/openid/help.go

@@ -26,6 +26,12 @@ var (
 	}
 
 	Help = config.HelpKVS{
+		config.HelpKV{
+			Key:         DisplayName,
+			Description: "Friendly display name for this Provider/App" + defaultHelpPostfix(DisplayName),
+			Optional:    true,
+			Type:        "string",
+		},
 		config.HelpKV{
 			Key:         ConfigURL,
 			Description: `openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"` + defaultHelpPostfix(ConfigURL),
@@ -40,19 +46,6 @@ var (
 			Key:         ClientSecret,
 			Description: `secret for the unique public identifier for apps` + defaultHelpPostfix(ClientSecret),
 			Type:        "string",
-			Optional:    true,
-		},
-		config.HelpKV{
-			Key:         ClaimName,
-			Description: `JWT canned policy claim name` + defaultHelpPostfix(ClaimName),
-			Optional:    true,
-			Type:        "string",
-		},
-		config.HelpKV{
-			Key:         ClaimUserinfo,
-			Description: `Enable fetching claims from UserInfo Endpoint for authenticated user` + defaultHelpPostfix(ClaimUserinfo),
-			Optional:    true,
-			Type:        "on|off",
 		},
 		config.HelpKV{
 			Key:         RolePolicy,
@@ -60,6 +53,12 @@ var (
 			Optional:    true,
 			Type:        "string",
 		},
+		config.HelpKV{
+			Key:         ClaimName,
+			Description: `JWT canned policy claim name` + defaultHelpPostfix(ClaimName),
+			Optional:    true,
+			Type:        "string",
+		},
 		config.HelpKV{
 			Key:         Scopes,
 			Description: `Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"` + defaultHelpPostfix(Scopes),
@@ -72,6 +71,12 @@ var (
 			Optional:    true,
 			Type:        "string",
 		},
+		config.HelpKV{
+			Key:         ClaimUserinfo,
+			Description: `Enable fetching claims from UserInfo Endpoint for authenticated user` + defaultHelpPostfix(ClaimUserinfo),
+			Optional:    true,
+			Type:        "on|off",
+		},
 		config.HelpKV{
 			Key:         KeyCloakRealm,
 			Description: `Specify Keycloak 'realm' name, only honored if vendor was set to 'keycloak' as value, if no realm is specified 'master' is default` + defaultHelpPostfix(KeyCloakRealm),