I want users to be able to sign in seamlessly using Google One Tap, but still have Keycloak manage authentication. Since One Tap is different from the standard OAuth flow (it provides a JWT credential instead of redirecting the user to Google's login page), I'm unsure about the best way to handle the token exchange with Keycloak.