Validate OIDC resource tokens against provider session state

[KrzysztofPajak]

Resolves no public issue
Type: feature

Issue

Protected resource APIs can accept provider-issued access tokens, but they need a resource-level way to reject tokens that are too old or belong to a subject whose provider sessions were revoked after token issuance.

Solution

Add MaximumTokenAgeSeconds to protected resource configuration and enforce it in OIDC token checks. The resource server now refuses provider tokens older than the configured resource limit and tokens issued before the provider subject revocation timestamp. Tests cover config validation, token age checks, and the customer pipeline behavior.

Breaking changes

None expected. Existing resources keep the default behavior unless MaximumTokenAgeSeconds is configured.

Testing

Not run during PR creation.

1. Run dotnet test src/Tests/Grand.Web.Common.Tests/Grand.Web.Common.Tests.csproj --filter OidcCustomerPipelineTests.
2. Configure a protected resource with MaximumTokenAgeSeconds.
3. Call the resource with a fresh provider access token and confirm it is accepted.
4. Call the resource with an expired-by-policy token or a token issued before subject revocation and confirm it is rejected.

[KrzysztofPajak]

Code review note: I reviewed the token-age and revocation changes against the security/.NET/resource-server checklist. I found no high-confidence issues. Token age and revocation checks run before customer resolution, and config validation covers non-positive MaxTokenAgeMinutes.\n\nI did not run the test suites.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.