Let's utilize group filtering in dex connector config by default for customers

[mogottsch]

Two problems:

1. Headers of requests that go through nginx-ingress are too large, because the Bearer tokens contain too many group memberships
2. Azure AD replaces the groups in the tokens with a description of how to get them, when there are too many groups. Dex is (probably) not compatible with this.

Several connectors have specific ways to limit the group memberships list.

Another benefit of group filtering is that if the user is not part of the configured groups dex won't issue a token at all.

The group names configured in rbac-operator should be present in the connector config. dex-operator can help to achieve this.

Todos

• Add documentation in the public docs on OIDC and in the docs on how to create a management cluster and give recommendation on how to setup the connector config.
• Talk to Teddyfriends about this

[mogottsch]

Creating documentation on how to create a dex/dex-operator configuration is a duplicate of #1518.

[mogottsch]

Because in the future setup of the dex connector config will be done by dex-operator we will only add group filtering to the example in the docs and then close this.