feat: sync the profile picture from the OIDC provider

Pocket ID exposes an avatar through the standard picture claim, pointing at
/api/users/{id}/profile-picture.png. On login the plugin now fetches that URL
and writes it to the Jellyfin user's profile image, so SSO users get their
avatar without setting one by hand.

The picture is fetched anonymously. The access token is deliberately not sent,
because the address ultimately originates from a token payload and must not be
treated as a trusted destination for credentials. Non-http(s) URLs, non-image
content types and anything over 5 MB are rejected, and an identical image is
not rewritten so the image cache is left alone. Any failure is logged and
swallowed: a broken avatar must never block a login.

Controlled by the new "Sync the profile picture" setting, on by default, with
the claim name configurable for providers that do not use "picture".

Co-Authored-By: Claude <noreply@anthropic.com>

Jellyfin.Plugin.OidcAuth/Configuration/PluginConfiguration.cs

@@ -38,6 +38,17 @@ public class PluginConfiguration : BasePluginConfiguration
     /// </summary>
     public string RoleClaim { get; set; } = "groups";
 
+    /// <summary>
+    /// Gets or sets the claim holding a URL to the user's profile picture.
+    /// </summary>
+    public string PictureClaim { get; set; } = "picture";
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the Jellyfin profile image is updated
+    /// from the picture claim on every OIDC login.
+    /// </summary>
+    public bool SyncProfilePicture { get; set; } = true;
+
     /// <summary>
     /// Gets or sets a comma separated list of role/group values that grant Jellyfin
     /// administrator rights. When empty, admin status is never modified by the plugin.