Support additional social providers

[Toby Hobson]

Conceptually it's similar to the Google flow however Google has a couple of key benefits:

1. It avoid redirects (which can screw up SPAs).
2. In most cases they provide a stable identifier (verified email)

Other providers typically use redirects and generally don't guarantee a verified email. We'd need to handle redirects in the same way we handle mailbox verification links. We'd also need to prompt the user to enter their email, then perform the verify email flow.

Why do we need the email?

1. We might want to send important security related emails
2. We'd probably want to offer an account recovery feature (via email). Otherwise a user may close their Facebook account (or get banned) and discover they can no longer log into the RP.
3. To prevent duplication. Without this a user could register using Facebook, then return and try to sign in using a passkey, email link or another social provider. When they are told no account exists they might try to register again or complain to the support team.