GHSA-9r87-mvcw-x35f: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder had two OIDC (OpenID Connect, a login standard) security flaws that could let an attacker take over a user's account: the system matched users by email without checking if the email was already linked to a different identity provider, and it didn't properly verify the `email_verified` claim (a flag stating whether the email was confirmed). An attacker who could sign in at the configured OIDC provider with a matching email could log in as the victim and access their workspaces and resources.