[OIDC] "profile" scope should use avatar instead of photo

External services should only ever see the avatar photo, if not explicitly requested otherweise.