[miki3421]

OIDC namespace mapping currently selects tenant credentials without verifying that the validated external identity owns the selected WhiskUser. Require exact, nonempty iss and sub values to match its SSO annotations before returning credentials.

The same check covers direct-token, password-grant, and device login, including existing resources encountered during auto-provisioning or a create conflict. Recheck the binding before releasing credentials and reject orphan metadata or an existing WhiskUser replaced during login.

Existing namespaces without SSO ownership annotations now return 403 for OIDC login. docs/OIDC.md explains how a cluster administrator can verify the owner and explicitly bind the namespace. Legacy OPS password authentication and the existing metadata credential format are preserved.

Validation:

• 54 unit tests passed against the current 0.9.0 source, including identity-binding regressions and the existing authentication and builder tests.
• All openserverless/common/*.py doctests passed; git diff --check passed.
• The same SSO implementation was tested on a K3s 0.9.0 baseline: 43 post-fix live checks passed, covering real Keycloak direct/password/device flows, auto-provisioning, legacy login, and unchanged Alpha/Beta applications.

Based on apache/openserverless-admin-api:0.9.0 at 2ecb071. This PR contains only the SSO fix, its tests, and related documentation; no workflow or component-version changes.