IdP check in custom authenticator

We can set override option for first broker login per IdP in Keycloak
but as VO membership can expire anytime, we need to check for entitlements
also in other flows (browser, etc.) which cannot be overriden in IdP's configuration
directly. Therefor this check need to be in the code.