Bind OIDC nonce and auth_time to authorization codes
The OpenID Connect nonce of the authorization request and the end-user
authentication time are now carried on the auth code so integrators can
issue the "nonce" and "auth_time" claims in the id_token on the token
request.
- AuthCodeInterface gains setNonce()/setAuthTime(); AuthCode stores both
- Doctrine mappings (orm/mongodb/couchdb) gain nullable nonce and
auth_time fields - OAuthStorage::createAuthCode() accepts and persists the nonce
- The nonce survives the consent round-trip through a hidden form field
- auth_time is deliberately left for the application to stamp: only it
knows when its user actually authenticated