fix: prevent intent token reuse and add expiry

(cherry picked from commit b1e60e7398)

internal/idp/providers/oauth/session.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"time"
 
 	"github.com/zitadel/oidc/v3/pkg/client/rp"
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
@@ -51,6 +52,13 @@ func (s *Session) FetchUser(ctx context.Context) (user idp.User, err error) {
 	return mapper, nil
 }
 
+func (s *Session) ExpiresAt() time.Time {
+	if s.Tokens == nil {
+		return time.Time{}
+	}
+	return s.Tokens.Expiry
+}
+
 func (s *Session) authorize(ctx context.Context) (err error) {
 	if s.Code == "" {
 		return ErrCodeMissing