Unbind authentication event lifetime from userinfo response

[ctriant]

This MR unbinds the authentication event lifetime validation from the userinfo response. The userinfo endpoint should only consider the provided token, that must fulfill the following criteria:

• the token is an access-token
• the access-token is valid (not expired or revoked)
• the access-token includes the openid scope

[ctriant]

@c00kiemon5ter @rohe