feat: add end_user_email claim to OIDC ID tokens (#8401)

* feat: add end_user_email claim to OIDC ID tokens

When a job is triggered by an app end user, the OIDC ID token now
includes the end_user_email claim automatically. The claim is omitted
for jobs without an end user (regular script/flow runs).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* update ee ref

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-741e92197bdaeab62b5b0cff86e629a3e94247c696ce1e222a0e830630141c13.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT end_user_email FROM job_perms WHERE job_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "end_user_email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "741e92197bdaeab62b5b0cff86e629a3e94247c696ce1e222a0e830630141c13"
+}

backend/ee-repo-ref.txt

@@ -1 +1 @@
-b2fde51087d0d0ee0223c15cafb4e8badddd2d13
+04689be519d724e437b64c2ec86d47b3270c9be8

backend/windmill-common/src/oidc_oss.rs

@@ -60,6 +60,8 @@ pub struct JobClaim {
     pub username: String,
     pub email: String,
     pub workspace: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub end_user_email: Option<String>,
 }
 
 #[cfg(not(feature = "private"))]