fix(oidc): use authenticated encryption for opaque tokens (#12017)

# Which Problems Are Solved

Opaque tokens now use authenticated encryption.

# How the Problems Are Solved

- Upgrade zitadel/oidc to v3.47
- Copy crypto implementation for refresh and session tokens (internal to
zitadel)
- Added config that allows validating old tokens for gradual roll-out

# Additional Changes

- Set NX cache for `integration-test-build` to `false`, working on a
seperate fix.

# Additional Context

- closes #11315

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: muhlemmer <[email protected]>

internal/command/org_test.go

@@ -2096,7 +2096,7 @@ func TestCommandSide_SetUpOrg(t *testing.T) {
 								Scopes:          []string{openid.ScopeOpenID},
 								AllowedUserType: domain.UserTypeMachine,
 								TokenID:         "tokenID",
-								Token:           "dG9rZW5JRDp1c2VySUQ", // token
+								Token:           "tokenID:userID",
 							},
 						},
 					},
@@ -2151,6 +2151,7 @@ func TestCommandSide_SetUpOrg(t *testing.T) {
 						Role: domain.RoleOrgOwner,
 					},
 				},
+				authAlgorithm: &mockAuthCrypto{},
 			}
 			got, err := r.SetUpOrg(tt.args.ctx, tt.args.setupOrg, tt.args.allowInitialMail, tt.args.permissionCheck, tt.args.userIDs...)
 			assert.ErrorIs(t, err, tt.res.err)