Summary

Flipt's OIDC auth method currently hardcodes the accepted ID token signing algorithm (RS256). Some providers sign tokens with other algorithms, causing login/verification failures.

Problem

• OIDC providers may issue ID tokens signed with algorithms other than RS256 (e.g. ES256, PS256, RS384/RS512).
• Flipt currently enforces RS256 only, so these providers cannot be used without code changes.

Proposal

• Add an algorithms field to authentication.methods.oidc.providers.<provider> configuration.
• Default remains ["RS256"] to preserve current behavior.
• Plumb the configured algorithms through to the OIDC client/provider configuration.

Backward compatibility

• Default stays RS256-only, so existing configs continue to work unchanged.

PR

#5362