[CILogon] support callable username_claim

[minrk]

restores compatibility with base class by allowing a callable, both on the class level OAuthenticator.username_claim, and on the per-idp level.

idp-level username_claim has priority, so class-level username_claim is only used when idp.username_derivation.username_claim is not defined.

closes #712 with by allowing callable username_claim but if we wanted a simple declarative solution to orcid (e.g. strip url prefix analogous to strip idp domain), we could also do that separately if it's likely to be common enough.

Example orcid config:

def orcid_username(user_info):
    assert user_info["idp"] == 'http://orcid.org/oauth/authorize'
    # Only modify usernames if orcid is used
    # oidc is of the form https://orcid.org/<orcid-id>
    return user_info['oidc'].split('/')[-1]

c.CILogonOAuthenticator.username_claim = orcid_username
c.CILogonOAuthenticator.idps = {
    'http://orcid.org/oauth/authorize': {
        'username_derivation': {
            # could set username_claim: callable here, too
            'action': 'prefix',
            'prefix': 'orcid',
    },
    'other': {
        'username_derivation': {
            'username_claim': 'sub', # username_claim callable not used
    },
}

[consideRatio]

a logging question, but otherwise lgtm!