OIDC: `userinfo_endpoint` is RECOMMENDED, but not REQUIRED

[johakoch]

According to https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata, the userinfo_endpoint is RECOMMENDED, but not REQUIRED.

So, if the openid-configuration, for whatever reason, does not include a userinfo_endpoint, no userinfo should be requested. Accordingly,

• the sub claim from the id token cannot be verified against the sub property from the userinfo response,
• no userinfo is stored in request.context.<oidc_name>.

[johakoch]

Are issues that are on a milestone not automatically closed if the linked PR is merged?

[malud]

Works, comfirmed with an Azure B2C application without an userinfo_endpoint within the configuration.