fix(hub): accept nonce-less old SPA logins

[shikokuchuo]

Summary

• temporarily accept validated, nonce-less ID tokens from deployed old SPAs
• retain strict sealed-cookie nonce validation for tokens that present a nonce
• retain stale_client callback reason for future compatibility branches; restoration is tracked in bd-mc00s2ws

Verification

• cargo build -p quarto-hub
• cargo nextest run -p quarto-hub (442 passed)
• Previously completed: cargo build --workspace and cargo nextest run --workspace
• Skipped a repeated workspace rerun and cargo xtask verify at requester direction. The earlier cargo xtask verify --skip-hub-build attempt failed in unrelated existing WASM project-create tests expecting the absent blog template.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.