Let users sign in with a known provider before linking a new provider to the user

[jorg-vr]

This pull request forces a user to confirm their identity before linking their new sign in method to an existing user.

The steps followed in the default scenario are as followed:

1. An existing users signs in using a new provider
2. We search for an existing identity for this user. (None can be found because it is the first sign in of this user using this provider)
3. Try to find an existing user in the same institution matching username or email (Which is found)
4. Check if user does not already have an identity for this provider
5. Save identity details and user id in session
6. Ask user to confirm that they have access to this user by signing in using a previously used login method
7. User signs in using known provider
8. Check if identity in session matches current signed in user
9. Add new identity to user
10. Notify user

I also added the linked sign in methods to the user detail screen

Misc

• I created a separate user_short partial for reuse (It is only used at a single place at the moment)
• I removed a failing test which was made specifically for merging token users into real users. As discussed this usecase does not happen
• flash messages can now contain multiple links instead of one

Closes #3668 .

[bmesuere]

I would prefer this to be on a separate page or at least a modal instead of a flash/alert. This is an important action for the user and it feels somewhat wrong to stash this away like this.

If we make linking more transparent like this, it might also be a good idea to list the linked providers on the profile page of a user?

[bmesuere]

Looks good 👍

Can you remove the drop shadow from the providers on the profile page? They look a lot like buttons now which they aren't. I think outlined-cards could work here, but I don't think I implemented them yet in the m3 refactor.

[niknetniko]

Looks good. I added a test I used to review this, and there was no reason to not commit it.