feat(oidc): token exchange impersonation (#7516)

* add token exchange feature flag

* allow setting reason and actor to access tokens

* impersonation

* set token types and scopes in response

* upgrade oidc to working draft state

* fix tests

* audience and scope validation

* id toke and jwt as input

* return id tokens

* add grant type  token exchange to app config

* add integration tests

* check and deny actors in api calls

* fix instance setting tests by triggering projection on write and cleanup

* insert sleep statements again

* solve linting issues

* add translations

* pin oidc v3.15.0

* resolve comments, add event translation

* fix refreshtoken test

* use ValidateAuthReqScopes from oidc

* apparently the linter can't make up its mind

* persist actor thru refresh tokens and check in tests

* remove unneeded triggers

internal/command/user_human_access_token_model.go

@@ -19,6 +19,8 @@ type UserAccessTokenWriteModel struct {
 	Scopes            []string
 	Expiration        time.Time
 	PreferredLanguage string
+	Reason            domain.TokenReason
+	Actor             *domain.TokenActor
 
 	UserState domain.UserState
 }
@@ -71,6 +73,8 @@ func (wm *UserAccessTokenWriteModel) Reduce() error {
 			wm.Expiration = e.Expiration
 			wm.PreferredLanguage = e.PreferredLanguage
 			wm.UserState = domain.UserStateActive
+			wm.Reason = e.Reason
+			wm.Actor = e.Actor
 			if e.Expiration.Before(time.Now()) {
 				wm.UserState = domain.UserStateDeleted
 			}