Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)

Summary

A security inconsistency was identified in the user_oidc app where group-based login restrictions were enforced in the browser OIDC flow but not in bearer token validation. This could allow users outside whitelisted groups to access the Nextcloud API with a valid bearer token.

Exploitation requires possession of the OAuth client_secret for the OIDC client configuration to exchange an authorization code into a bearer token, limiting practical exploitability to scenarios where an attacker has privileged access to the identity provider infrastructure.