Add configurable multi-auth support for local and OIDC logins

[holger-dev]

This PR extends BookStack authentication so multiple login methods can be enabled at the same time, instead of forcing a single global auth method.

The main use case is running OIDC alongside local BookStack accounts. With this change, admins can keep OIDC as the primary login method while still creating internal users with local passwords who can sign in through the normal login form.

Key changes:

• Adds support for AUTH_METHODS as a list of enabled auth methods
• Adds AUTH_PRIMARY_METHOD for preferred UI/redirect behavior
• Keeps backward compatibility with existing single-method setups via AUTH_METHOD
• Updates login/logout flow to track the actual auth method used for the session
• Allows standard/local login to coexist with OIDC, LDAP, or SAML
• Keeps registration, password reset, and password change available whenever standard auth is enabled
• Updates admin user handling so local users can be created without requiring an external_auth_id when standard auth is active
• Hardens install/deploy behavior by clearing stale Laravel package/service cache files before Composer install, avoiding issues with removed dev providers such as Clockwork

Example configuration:
AUTH_METHOD=standard
AUTH_METHODS=standard,oidc
AUTH_PRIMARY_METHOD=oidc
AUTH_AUTO_INITIATE=false

This allows:

• OIDC login for externally managed users
• local BookStack users with password-based login
• admin-managed fallback/internal accounts without external identity mapping

[ssddanbrown]

Thanks @holger-dev for offering this PR.

Unfortunately this still isn't something I'd look to maintain/support at this time, for pretty much the same reasons as I stated on the issue, although I appreciate demand has increased since.
This is especially true at this time, after a bunch of recent security releases which have put me on edge (more than usual) when it comes to security critical elements.

That's not to say such a feature won't eventually be added, but I just can't see it being included within the next year or so. Especially as there are some other elements (a revamp to login sessions) which I'd probably like to do before something like this.

Thanks again for offering this code though, but due to the above, I'm going to go ahead and close this off.