Users can link/unlink multiple IdPs to their account

[sandhose]

Part of #1874

Users should be able to dynamically link/unlink IdP identities to their account

Linking is already possible, but is not user-discoverable

Tasks

Preview Give feedback

1. Use the upstreamOauth2Links on users to show the list of upstream accounts in the UI
2. Use the upstreamOAuth2Providers list to suggest linking with new providers
3. Generate a link to start a new IDP authentication like [mas]/upstream/authorize/[ULID of the provider]. It might be worth exposing that URL in the GraphQL API, as constructing it in the frontend might be brittle
4. Add a mutation to remove a link (not sure if that should be allowed by default?) and wire that up

[sandhose]

Here are the designs:

I can provide a proper Figma file if needed