Keycloak: Account for millisecond truncation of action-token expirati…

…on marker in SessionPropagationActionTokenHandler

keycloak/extensions/src/main/java/com/github/thomasdarimont/keycloak/custom/endpoints/offline/SessionPropagationActionTokenHandler.java

@@ -40,7 +40,7 @@ public Response handleToken(SessionPropagationActionToken token, ActionTokenCont
 
         // mark token as consumed
         var singleUseObjectProvider = session.getProvider(SingleUseObjectProvider.class);
-        singleUseObjectProvider.put(token.serializeKey(), token.getExp() - Time.currentTime(), null); // Token is invalidated
+        singleUseObjectProvider.put(token.serializeKey(), token.getExp() - Time.currentTime() + 1, null); // mark token as invalidated, +1 second to account for rounding to seconds
 
         var authSession = tokenContext.getAuthenticationSession();
         var authenticatedUser = authSession.getAuthenticatedUser();