Better way to set custom claims for providers

[ckohen]

Goals

1. claims param should allow specifying only the callbacks needed
2. each claim callback should allow specifying only the claims needed
3. Prevents over-requesting permissions that are unnecessary for your application

Non-Goals

No response

Background

Prior to #11685 it was possible to omit default claims by specifying them as undefined due to the nature of how JSON.stringify works. This always seemed like a hack, but it worked really well.

Due to this lines change: https://github.com/nextauthjs/next-auth/pull/11685/files#diff-c750afcff4619cbf892c75d6bdbb65742b8b252710ac5f203f420f37c3906fa8R24 that is no longer possible. You can still workaround it by abusing JSON.stringify's behavior again, eg

params: {
  scope: 'openid',
  claims: {
    id_token: {
      email: {
        toJSON() {
          return undefined;
        },
      },
      picture: null,
      preferred_username: null,
    },
  },
},

However, this is very clearly a workaround

Proposal

I see two potential options for this:

1. Make the defaults more reaosnable, and requiring the least amount of permissions (that way more can be added if necessary)
2. Make it possible to completely override these types of options, maybe with a callback or specifying an array instead? Twitch might be an outlier here, not sure, but it seems if we could specify an array for the claims then that could be transformed to the object twitch wants, making the claims much less confusing for the end user.