fix(oidc): use authenticated encryption for opaque tokens (#12017)

# Which Problems Are Solved

Opaque tokens now use authenticated encryption.

# How the Problems Are Solved

- Upgrade zitadel/oidc to v3.47
- Copy crypto implementation for refresh and session tokens (internal to
zitadel)
- Added config that allows validating old tokens for gradual roll-out

# Additional Changes

- Set NX cache for `integration-test-build` to `false`, working on a
seperate fix.

# Additional Context

- closes #11315

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: muhlemmer <[email protected]>

internal/api/oidc/auth_request.go

@@ -2,7 +2,6 @@ package oidc
 
 import (
 	"context"
-	"encoding/base64"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -204,15 +203,6 @@ func (o *OPStorage) AuthRequestByCode(ctx context.Context, code string) (_ op.Au
 	panic(o.panicErr("AuthRequestByCode"))
 }
 
-// decryptGrant decrypts a code or refresh_token
-func (o *OPStorage) decryptGrant(grant string) (string, error) {
-	decodedGrant, err := base64.RawURLEncoding.DecodeString(grant)
-	if err != nil {
-		return "", err
-	}
-	return o.encAlg.DecryptString(decodedGrant, o.encAlg.EncryptionKeyID())
-}
-
 func (o *OPStorage) SaveAuthCode(ctx context.Context, id, code string) (err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() {
@@ -529,7 +519,7 @@ func (o *OPStorage) GetRefreshTokenInfo(ctx context.Context, clientID string, to
 		span.EndWithError(err)
 	}()
 
-	plainToken, err := o.decryptGrant(token)
+	plainToken, err := o.authAlg.DecryptToken(token)
 	if err != nil {
 		return "", "", op.ErrInvalidRefreshToken
 	}