OpenID Connect sign-in with a consent step

Added

• OpenID Connect sign-in. ShellBase now carries an OpenID Connect flow end to end, with a hand-off page that takes you to the sign-in and back.
• A consent step before access is granted. The flow ends on a consent screen: nothing is granted until you approve it there.

Improved

• A flow that cannot complete says so. Error handling in the sign-in and the redirects around consent were reworked, so a failed flow reports the error and sends you to a defined destination.