Surface upstream ID tokens through auth middleware

[jhrozek]

Description

Part of XAA / ID-JAG support (#5218). XAA Step A requires the user's upstream ID token as the subject_token in the RFC 8693 exchange. This change plumbs ID tokens from the upstream OIDC login through to the auth middleware so strategies can access them at request time.

Changes:

• Adds UpstreamIDTokens map[string]string to pkg/auth.Identity, mirroring the existing UpstreamTokens access-token map
• Extends pkg/auth/upstreamtoken.UpstreamCredential to carry an IDToken field alongside AccessToken
• Updates InProcessService.GetAllUpstreamCredentials to carry through the rotated ID token when a refresh produces one (OIDC Core 1.0 §12.2), falling back to the original login ID token otherwise
• Auth middleware populates UpstreamIDTokens from the credential map on every authenticated request

Branch

xaa-test-upstream-id-tokens