return user on auth

[butonic]

born out of cs3org/reva#382 and the previous discussion in cs3org/reva#239 (comment)

The userid is not good enough:

• Depending on the authentication mechanism we can provide more 'claims' than just the id
• splitting auth from userlookup doubles the number of ldap lookups (one to check credentials, one to fetch user metadata ... which could be done in the same request)
• oidc does a user metadata lookup during authentication ... but has no way to forward the resolved claims to the user manager

Even the basic auth provider can return a username and a userid.

The job of the auth provider is to establish the identity of the user and return a stable identifier. But he should be allowed to provide more 'claims'.

I also cleaned up the user type to get rid of the direct subjectand issuer members, which are part of the id. And I added the mail_verified member ....

TBH I would just add all oidc standard claims ... in a subsequent PR. For now, this would be awesome!

[labkode]

@butonic don't make them backwards compatible as no one issuing them yet so we can make them clean from the first version

[butonic]

ok, that also updated the proto.lock ...

[butonic]

merged as part of #48