Add OpenID Connect nonce and auth_time support
The "nonce" authorization request parameter is now accepted, bound to the
authorization code and exposed to token listeners through
OAuthTokenGrantedEvent::getNonce() so integrators can replay it in the
id_token.
An authentication timestamp stamped on the authorization code by the storage
is read back on the token request and exposed through
OAuthTokenGrantedEvent::getAuthTime(). It is a server-side value, never read
from the authorization request.
BC breaks for custom storages/models:
- IOAuth2GrantCode::createAuthCode() takes a 7th optional argument $nonce.
- IOAuth2AuthCode declares getNonce() and getAuthTime().
Full Changelog: 1.9.0...2.0.0