Cross clients improvement - requesting client ID always added to the audience claim

add client request timeout

storage/kubernetes: Log before registering custom resources

Logging before attempting to make any connection to Kubernetes is useful when the connection hangs and dex is killed before it can log any errors.

Add Documentation about customresourcedefinitions creation role

Replace docker-build script with multi-stage build

storage/kubernetes: Correct the OfflineSession object CRD definition

Documentation: add docs for TPR to CRD migration

storage/kubernetes: add CRD support

Updates coreos themes and icons for various providers

Makefile: error out if go files aren't correctly formatted

Noticed in #1058 that our gofmt make target isn't actually erroring
if someone commits misformatted code.

server: fix panic caused by deleting refresh token twice through api

Documentation: fix redirect caveat description

The redirect caveat is being removed to avoid user confusion and is
not important outside of testing.

Documentation: OIDC conformance test setup

storage/static.go: storage backend should not explicitly lower-case email ids.

*: add "getting started" example for LDAP

server: set sane bcrypt cost upper bound

connector/github: fix groups scope check when 'orgs' is populated

When connecting to GitHub Enterprise, force email verified field to true

We should always check if a user is in any orgs or teams specified
in config, and whether the groups scope is also included in client
requests. If not, return an error, because dex wouldn't have required
permissions to do the request anyway (need read:org).