Keycloak provider breaks if usernames change on Keycloak

[lf-]

The username is used as the external ID on Gerrit: https://gerrit.googlesource.com/plugins/oauth/+/refs/heads/master/src/main/java/com/googlesource/gerrit/plugins/oauth/KeycloakOAuthService.java#125

This is fundamentally broken: users must be able to freely change their usernames without breaking OAuth (I will not go into why usernames must be changeable, but let's assume it is a given).

In fact, this is correctly implemented for the GitHub provider: an immutable machine-readable ID is used for the external ID in Gerrit, as should be the case: https://gerrit.googlesource.com/plugins/oauth/+/refs/heads/master/src/main/java/com/googlesource/gerrit/plugins/oauth/GitHubOAuthService.java#121

It appears that this can be fixed by using "sub" from the ID token instead of the username for the external ID, and using the same "fix legacy IDs" approach as is implemented on the GitHub plugin as well.