Preseve session ID via the ID token

[gklei]

Sends the ID token with the refresh request so it can be used to validate the authenticated fulcra_session_id, and attach it to the new access and ID tokens after refresh.

[kaiju]

Fun question: What happens when we need to refresh the ID token?

[lancelets]

Fun question: What happens when we need to refresh the ID token?

@gklei and I tried changing the ID token expiration time to be relatively long (currently 30 days) and setting a maximum refresh token expiration to match. I think we could set that to a very long time if we want them to effectively not expire.

I also like your idea of using ignoreExpiration: true when verifying the ID token in the refresh flow. That would allow us to use the ID token for more normal purposes with a normal lifespan if we want to at some point. I'll plan on adding that and reverting the expiration changes, unless a long ID token expiration time sounds better than accepting an expired ID token—I'm going in circles about the trade-offs.