UserInfo and ID token purpose revision

[byewokko]

UserInfo and ID token each serve a different purpose:

• UserInfo returns information about the currently logged-in end-user identity.
• ID token can contain some of that information as well, plus it should contain info about what happened at the authentication time.

In the current implementation, they both contain the same information (or almost the same).

Requested changes

• UserInfo endpoint should return UP TO DATE end-user information. When e.g. the user email changes mid-session, it should return the new email value.
• UserInfo should only contain claims about the end-user identity, not about current session (session ID, expiration, authorized resources, used login methods).
• Current session-related claims can be included in the ID token.