Skip absent email_verified for Microsoft OIDC

The nOAuth fix set trustProviderEmail to false, requiring the
email_verified claim. Microsoft never emits that claim, so the check
rejected every legitimate Microsoft login before the xms_edov check
was reached.

Restore trustProviderEmail to true and keep the required xms_edov
claim, which is the actual nOAuth mitigation: Azure sets it only after
verifying the issuing tenant owns the email's domain, so a token
lacking it is still rejected before any identity is matched.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/iam/oidc/service.go

@@ -226,8 +226,10 @@ func NewService(
 				RedirectURL:  baseURL + "/api/connect/v1/oidc/microsoft/callback",
 				Scopes:       []string{"openid", "email", "profile"},
 			},
-			jwksURL:                         microsoftJWKSURL,
-			trustProviderEmail:              false,
+			jwksURL: microsoftJWKSURL,
+			// Microsoft never emits email_verified; nOAuth is
+			// mitigated by the required xms_edov claim below.
+			trustProviderEmail:              true,
 			requireEmailDomainOwnerVerified: true,
 			issuerValidator: func(iss string) bool {
 				return strings.HasPrefix(iss, "https://login.microsoftonline.com/") &&