User Authentication / Identity providers

[resure]

We need to have out of the box ability to integrate with at least one external IAM system (currently considering Zitadel or Keycloak).

Scope of this task includes user authentication (login) to UI and APIs but excludes per-object ACLs and data row security (see #100 for information on authorization features).