Moved JWT builder in IdTokenResponse to protected method

[sgomez]

It's very hard to add more claims or headers to id_token. This PR moves builder generation in a protected method, so the class can be extended to add more claims. Vg:

<?php

class MyIdTokenResponse extends IdTokenResponse
{
    protected function getBuilder(AccessTokenEntityInterface $accessToken, UserEntityInterface $userEntity)
    {
        // Add required id_token claims
        $builder = parent::getBuilder($accessToken, $userEntity)
            ->setHeader('kid', 'oidc')
        ;

        return $builder;
    }
}

This not cause any BC.