Allow restricting the set of home servers for which tokens are issued

[inducer]

MSC4195 says:

An access control policy should be applied based on the result of the OpenID token validation. For example, access might be restricted to users of a particular homeserver or to users with a specific role.

AFAICT, as of 7880124, that's not implemented. It'd be nice if it was.

[fkwp]

next step is #67

Other than that we don't have anything on the backlog right now.

[inducer]

Thanks! #67 would meet my needs, feel free to add "Closes: #95" to #67.