Console and Google authentication improvements

[sesposito]

Resolves #2530 #2529

[Copilot]

Pull request overview

This PR tightens authentication/authorization behavior in two areas: (1) Google ID token validation now restricts accepted aud/azp claims to configured OAuth client IDs, while preserving the auth-code exchange flow; (2) console user management now enforces ACL constraints for user creation and password resets, including race-safe authorization by locking the target row.

Changes:

• Add configurable Google OAuth client ID allowlist and enforce it during Google ID token verification (aud/azp).
• Prevent exchanging JWT-shaped strings at the Google auth-code exchange endpoint; improve debug logging on validation failures.
• Enforce console ACL constraints when creating users and when resetting passwords (with transaction-row locking), with new test coverage.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
social/social.go	Adds accepted Google client ID set, enforces aud/azp, and avoids exchanging JWT-shaped values.
social/google_token_audience_test.go	Adds coverage for Google aud/azp validation and auth-code flow behavior.
server/console_user.go	Adds ACL grant validation on user creation; adds target ACL authorization + row lock in password reset.
server/console_user_reset_password_acl_test.go	Adds tests ensuring password reset authorizes against target ACL before updating.
server/console_user_add_acl_test.go	Adds tests ensuring AddUser rejects invalid ACL grants before side effects.
server/config.go	Adds google_auth.client_ids config + deep clone support.
server/config_test.go	Adds tests for parsing and cloning google_auth.client_ids.
main.go	Wires configured Google client IDs into the social client.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.