As an administrator of Quay I would like to define and limit the user's domain that can login using Google External Authentication.

This can be achieved by sending (and validating) the `hostedDomain` (hd) parameter in the OAuth2 request to Google.

https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters