add the IDP display name to the downstream ID token's sub claim

To make the subject of the downstream ID token more unique when
there are multiple IDPs. It is possible to define two IDPs in a
FederationDomain using the same identity provider CR, in which
case the only thing that would make the subject claim different
is adding the IDP display name into the values of the subject claim.

internal/federationdomain/endpoints/token/token_handler.go

@@ -394,7 +394,7 @@ func upstreamLDAPRefresh(
 		Groups:               oldUntransformedGroups,
 		AdditionalAttributes: additionalAttributes,
 		GrantedScopes:        grantedScopes,
-	})
+	}, p.DisplayName)
 	if err != nil {
 		return errUpstreamRefreshError().WithHint(
 			"Upstream refresh failed.").WithTrace(err).