fix(oidc): use authenticated encryption for opaque tokens (#12017)

# Which Problems Are Solved

Opaque tokens now use authenticated encryption.

# How the Problems Are Solved

- Upgrade zitadel/oidc to v3.47
- Copy crypto implementation for refresh and session tokens (internal to
zitadel)
- Added config that allows validating old tokens for gradual roll-out

# Additional Changes

- Set NX cache for `integration-test-build` to `false`, working on a
seperate fix.

# Additional Context

- closes #11315

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: muhlemmer <[email protected]>

cmd/setup/03.go

@@ -86,12 +86,12 @@ func (mig *FirstInstance) Execute(ctx context.Context, _ eventstore.Event) error
 		nil,
 		userAlg,
 		nil,
+		nil,
+		nil,
 		oidcEncryption,
 		nil,
 		nil,
 		nil,
-		nil,
-		nil,
 		0,
 		0,
 		0,

cmd/setup/setup.go

@@ -565,9 +565,9 @@ func startCommandsQueries(
 		keys.SMS,
 		keys.User,
 		keys.DomainVerification,
-		keys.OIDC,
 		keys.SAML,
 		keys.Target,
+		keys.OIDC,
 		&http.Client{},
 		permissionCheck,
 		sessionTokenVerifier,