Support Google's hosted domain parameter

### Problem Statement We would love to be able to set the hosted domain (`hd`) parameter in the issuer URL, so that our users only see the correct Google accounts when logging in. Potentially also validate that hd claim post-auth for extra security. ### Proposed Solution _No response_ ### Additional information _No response_ ### Acceptance Criteria _No response_ ### Preflight Checklist - [x] I could not find a solution in the [documentation](https://github.com/jkroepke/openvpn-auth-oauth2/wiki), the [FAQ](https://github.com/jkroepke/openvpn-auth-oauth2/wiki/FAQ), the existing issues or discussions.