PLU-91: [SGID-LOGIN-5] **RFC** Enable multi-hat users to select email

[ogp-weeloong]

Problem

We want to support SGID login as an alternative to OTP.

Solution

As opposed to the usual SGID approach of creating routes on the back end, we will implement SGID using front end routes + GraphQL instead (to avoid us mixing and matching classic REST vs GraphQL where possible).

High Level Approach

See #202 for full details.

1. Create a new "login with SGID" GraphQL mutation, which logs in users with a single work email, or return the list of work emails to the front end.
2. Create a new "login with selected SGID" mutation, which logs multi-hatted users in after they have selected their email.
3. Create a new login with SGID button, which sends the user to the SGID servers to start the login process
4. Add a new front end route, /login/sgid/redirect, which processes auth data from SGID + renders work email list for selection.

PR Notes

This PR enhances step 4 to enable multi-hatted users to select and login with a particular work email.

RFC Needed

UX inputs pls.

SCREENSHOTS

Tests

• Simulate having multiple emails by editing the loginWithSgid mutation, and check that I get redirected to this selection screen.
• From the previous test, select an email and check that I am logged in with the correct email.
• Manually send a wrong email to this mutation and check that I get an error instead of being successfully logged in.
• Regression test: check that I can still login with OTP
• Regression test: check that I can still login with SGID as a single hat user, without seeing this selection screen.

[linear]

PLU-91 sgID login using POCDEX