feat(jans-auth-server): allow end session with expired id_token_hint (by checking signature and aud/sid)

[yuriyz]

Describe the issue

Allow end session with expired id_token_hint (by checking signature and audi/sid)

oxauth counterpart: GluuFederation/oxAuth#1721

Actual behavior

At present, AS is "verifying" the id_token_hint by looking it up in the token store. If the token has expired it will have been purged, and so the request to end_session is rejected.

Expected behavior

Instead of trying to look up the ID token, to validate the id_token_hint:

1. Verify the signature on the JWT if present, also checking that it was signed by one of oxAuth's signing keys.
2. As per the spec:
   • Use the sid claim in the it token hint to look up the session in the 0xAuth session store.
   • If a session is found, check that the aud claim in the token matches one of the client_ids belonging to the session.

If sid of id_token_hint does not match request will be rejected.

New configuration properties:

• allowEndSessionWithUnmatchedSid with default value false. If true, sid check will be skipped.
• rejectEndSessionIfIdTokenExpired with default value false. If true and id_token is not found in db, request will be rejected.