Use sub claim if oid is missing

[bgavrilMS]

Fixes #4140

[jmprieur]

LGTM
Was GetUniqueId() already defined?

[bgavrilMS]

LGTM Was GetUniqueId() already defined?

Yeah, it's used to compute AuthenticationResult.UniqueId which is public API. I changed the comments on it.

[gladjohn]

public string GetUniqueId()
{
    return ObjectId ?? Subject;
}

what does subject return?

[bgavrilMS]

public string GetUniqueId()
{
    return ObjectId ?? Subject;
}

what does subject return?

sub claim. I added comments everywhere on this. Seems to be mandatory as per OIDC spec. Should be an ID for app + user, but can theoretically be different for app2 + user. Stable enough for token caching for sure.