Remove principals when OIDC provisioner is used.

OIDC provisioners use an identity function to get the principals
for a given email, so there's no need to provide principals.
Moreover, if the email and principal does not match
`step ssh proxycommand` will fail if the username does not match
the email address.

For an unknown reason this feature was removed in an unrelated
commit: smallstep/cli@2c9b200

Fixes smallstep/certificates#550

command/ssh/login.go

@@ -202,6 +202,7 @@ func loginAction(ctx *cli.Context) error {
 	// provisioner is responsible for setting default principals by using an
 	// identity function.
 	if email, ok := tokenHasEmail(token); ok {
+		principals = []string{}
 		subject = email
 	}
 

command/ssh/proxycommand.go

@@ -147,6 +147,7 @@ func doLoginIfNeeded(ctx *cli.Context, subject string) error {
 	// provisioner is responsible for setting default principals by using an
 	// identity function.
 	if email, ok := tokenHasEmail(token); ok {
+		principals = []string{}
 		subject = email
 	}