fix(oidc): use authenticated encryption for opaque tokens (#12017)

# Which Problems Are Solved

Opaque tokens now use authenticated encryption.

# How the Problems Are Solved

- Upgrade zitadel/oidc to v3.47
- Copy crypto implementation for refresh and session tokens (internal to
zitadel)
- Added config that allows validating old tokens for gradual roll-out

# Additional Changes

- Set NX cache for `integration-test-build` to `false`, working on a
seperate fix.

# Additional Context

- closes #11315

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: muhlemmer <[email protected]>

internal/command/crypto_test.go

@@ -99,6 +99,20 @@ func testSecretGeneratorAddedEvent(typ domain.SecretGeneratorType) *instance.Sec
 	)
 }
 
+type mockAuthCrypto struct{}
+
+func (m *mockAuthCrypto) EncryptToken(data string) (string, error) {
+	return data, nil
+}
+
+func (m *mockAuthCrypto) DecryptToken(token string) (string, error) {
+	return token, nil
+}
+
+func (m *mockAuthCrypto) LegacyTokenEnabled() bool {
+	return false
+}
+
 func Test_newCryptoCode(t *testing.T) {
 	type args struct {
 		typ domain.SecretGeneratorType