Generate ID token if it is not refreshed

[sberyozkin]

Fixes #29144

This PR addresses a case where a provider does not return a new ID token after a token refresh in a similar way we handle GitHub and other OAuth2-only provider responses for the initial authorization code flow exchanges which is used in Renarde - we generate an internal ID token but besides we also preserve the orginal ID token claims in the newly generated ID token for the application to keep which needs access to the ID token claims - because it works for such application at the start where an original ID token is returned.

Here is a summary, most of the time was spent on getting the test passing:

• Refresh token grant is activated if ID token has expired or nearly expired in which case it is an auto-refresh after the ID token has been verified and confirmed to be valid - so if the refresh token grant response does not return new ID token, to avoid NPE, we now do the following: 1) if it was auto-refresh then keep using the original ID token which is still valid 2) if ID token was expired then generate a new ID token, but retain the original claims minus issued at and expiry claims
• It won't be done by default though, users need to allow it with quarkus.oidc.authentication.id-token-required=false
• Updated the test to verify this flow - the OidcResource test resource emulating OIDC provider does not return ID token during the refresh (Keycloak based tests will have real refresh token returned so all the variations are covered)
• Newly generated tokens have 5 mins lifetime by default, so I had to limit it to 5 secs with a smallrye-jwt-build config property since the test expects the session expire after 6+ secs.

This is really it, no OIDC logic is affected, just a support for extending the session in those users where providers other than Keycloak do not recycle ID tokens...

CC @pedroigor

[sberyozkin]

Sorry, I focused on getting the related test passing and ignored checking other tests, will fix

[sberyozkin]

Was a unit test issue after I refactored a bit the token decoding code