connectors/oidc: truely ignore "email_verified" claim if configured that way

Fixes #1455, I hope.

Signed-off-by: Stephan Renatus <srenatus@chef.io>

connector/oidc/oidc.go

@@ -219,7 +219,11 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
 	}
 	emailVerified, found := claims["email_verified"].(bool)
 	if !found {
-		return identity, errors.New("missing \"email_verified\" claim")
+		if c.insecureSkipEmailVerified {
+			emailVerified = true
+		} else {
+			return identity, errors.New("missing \"email_verified\" claim")
+		}
 	}
 	hostedDomain, _ := claims["hd"].(string)
 
@@ -237,10 +241,6 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
 		}
 	}
 
-	if c.insecureSkipEmailVerified {
-		emailVerified = true
-	}
-
 	if c.getUserInfo {
 		userInfo, err := c.provider.UserInfo(r.Context(), oauth2.StaticTokenSource(token))
 		if err != nil {