feat(auth)!: remove support for obsolete OpenID 2.0 draft (#40231)

Remove OpenID 2.0 authentication. The spec is an obsolete draft, major
providers dropped it years ago, and the code keeps needing security
fixes like https://github.com/go-gitea/gitea/pull/39642. OpenID Connect
and OAuth2 are unaffected. Docs: https://gitea.com/gitea/docs/pulls/633.

- The `[openid]` settings, OpenID sign-in, sign-up and account
association are gone
- A migration drops the `user_open_id` table with all user OpenID URIs
- Accounts registered via OpenID have a random password and regain
access via password reset

Fixes: https://github.com/go-gitea/gitea/issues/1310
Fixes: https://github.com/go-gitea/gitea/issues/3521

modelmigration/migrations.go

@@ -442,6 +442,7 @@ func prepareMigrationTasks() []*migration {
 		newMigration(363, "Add release_id to reaction table", v29.AddReleaseIDToReaction),
 		newMigration(364, "Add new table project_workflow", v29.AddProjectWorkflow),
 		newMigration(365, "Normalize legacy repository unit and login source JSON", v29.NormalizeLegacyConfigJSON),
+		newMigration(366, "Drop user_open_id table", v29.DropUserOpenIDTable),
 	}
 	return preparedMigrations
 }

modelmigration/v29/v366.go

@@ -0,0 +1,14 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+)
+
+func DropUserOpenIDTable(_ctx context.Context, x base.EngineMigration) error {
+	return x.DropTables("user_open_id")
+}

modelmigration/v29/v366_test.go

@@ -0,0 +1,33 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"testing"
+
+	"gitea.dev/modelmigration/migrationtest"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDropUserOpenIDTable(t *testing.T) {
+	type UserOpenID struct {
+		ID int64 `xorm:"pk autoincr"`
+	}
+
+	x, cleanup := migrationtest.PrepareTestEnv(t, 0, new(UserOpenID))
+	defer cleanup()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	exists, err := x.IsTableExist("user_open_id")
+	require.NoError(t, err)
+	require.True(t, exists)
+	require.NoError(t, DropUserOpenIDTable(t.Context(), x))
+	exists, err = x.IsTableExist("user_open_id")
+	require.NoError(t, err)
+	require.False(t, exists)
+	require.NoError(t, DropUserOpenIDTable(t.Context(), x))
+}