OAuth user creation: Password-less activation URL

[FlxRobole]

So basically this is a continuation/re-calibration of #1478. Looking at the number of issues and questions raised concerning the latest oauth-changes in v6, some more effort is likely needed here. #15435 proposes to extend the docs, but I'm not sure if this actually solves any of the UX problems some of us are having. Instead, I wonder if there is a way to keep the v5-like pre-creation of user accounts by hand without having to deal with (temporary) passwords and without having to enable create_user.

Let me think out loud:

1. Matching the email of a user-object returned by the oauth-provider (as done in v5 with trusted_providers configured) is insecure, got it.

2. One manual way seems to be to pre-create the user account in CP, let the user sign in by password once and connect to the target provider. While this works, it encourages users to deal with passwords, something that our clients try to avoid.

3. One automated way is to enable create_user and either assign roles automatically using withUser or to assign the role by hand after the user has connected the first time. As Turn off automatic user creation on login when OAuth is enabled #1006 correctly states, this feels strange as any third-party could potentially access CP. This encourages anybody with an account at the configured provider to have a statamic account as well, something that our clients try to avoid ("why blacklist when you can whitelist?").

My idea:

Looking at the current user creation process in CP, I wonder whether we could adapt the "Activation URL" feature. While this URL currently displays a form that requires the user to define a password, we could instead (or in addition) provide a "connect" button for each defined provider so that users can skip the password-creation altogether. This would mitigate the problems mentioned in my thoughts above.