fix: Revert "feat(oidc): Added new claim in userinfo response to return all requested audience roles (#9861)" (#10874)

# Which Problems Are Solved

#9861 added a `urn:zitadel:iam:org:projects:roles` claims to include all
roles from all requested roles. The intention was to return them on the
userinfo endpoint. But since the claims might also be returned in the id
and access tokens, they can grow big quite fast and break the size
limits for headers.

# How the Problems Are Solved

This PR revert the feature. The information for roles of other projects
is already available as a dedicated claim (for each project):
```json
  "urn:zitadel:iam:org:project:328813096124547391:roles": {
    "r2": {
      "306639557921669515": "zitadel.localhost"
    },
    "r3": {
      "306639557921669515": "zitadel.localhost"
    },
    "role": {
      "306639557921669515": "zitadel.localhost"
    }
  },
  "urn:zitadel:iam:org:project:341406882914631999:roles": {
    "role": {
      "306639557921669515": "zitadel.localhost",
      "328237605990695334": "aa.localhost"
    },
    "test": {
      "306639557921669515": "zitadel.localhost",
      "328237605990695334": "aa.localhost"
    }
  },
  "urn:zitadel:iam:org:project:roles": {
    "r2": {
      "306639557921669515": "zitadel.localhost"
    },
    "r3": {
      "306639557921669515": "zitadel.localhost"
    },
    "role": {
      "306639557921669515": "zitadel.localhost"
    }
  }
 ```

# Additional Changes

None

# Additional Context

- relates to #9861
- noted issues in production
- requires backport to v4.x

(cherry picked from commit b8bff3cdea)

internal/api/oidc/client.go

@@ -25,7 +25,6 @@ const (
 	ScopeProjectsRoles              = "urn:zitadel:iam:org:projects:roles"
 	ClaimProjectRoles               = "urn:zitadel:iam:org:project:roles"
 	ClaimProjectRolesFormat         = "urn:zitadel:iam:org:project:%s:roles"
-	ClaimProjectsRoles              = "urn:zitadel:iam:org:projects:roles"
 	ScopeUserMetaData               = "urn:zitadel:iam:user:metadata"
 	ClaimUserMetaData               = ScopeUserMetaData
 	ScopeResourceOwner              = "urn:zitadel:iam:user:resourceowner"
@@ -96,7 +95,7 @@ func (o *OPStorage) GetPrivateClaimsFromScopes(context.Context, string, string,
 func checkGrantedRoles(roles *projectsRoles, grant query.UserGrant, requestedRole string, isRequested bool) {
 	for _, grantedRole := range grant.Roles {
 		if requestedRole == grantedRole {
-			roles.Add(grant.ProjectID, grantedRole, grant.ResourceOwner, grant.OrgPrimaryDomain, isRequested, false)
+			roles.Add(grant.ProjectID, grantedRole, grant.ResourceOwner, grant.OrgPrimaryDomain, isRequested)
 		}
 	}
 }
@@ -107,11 +106,9 @@ type projectsRoles struct {
 	projects map[string]projectRoles
 
 	requestProjectID string
-
-	requestAudIDs map[string]struct{}
 }
 
-func newProjectRoles(projectID string, grants []query.UserGrant, requestedRoles []string, roleAudience []string) *projectsRoles {
+func newProjectRoles(projectID string, grants []query.UserGrant, requestedRoles []string) *projectsRoles {
 	roles := new(projectsRoles)
 	// if specific roles where requested, check if they are granted and append them in the roles list
 	if len(requestedRoles) > 0 {
@@ -120,19 +117,18 @@ func newProjectRoles(projectID string, grants []query.UserGrant, requestedRoles
 				checkGrantedRoles(roles, grant, requestedRole, grant.ProjectID == projectID)
 			}
 		}
+		return roles
 	}
 	// no specific roles were requested, so convert any grants into roles
 	for _, grant := range grants {
 		for _, role := range grant.Roles {
-			for _, projectAud := range roleAudience {
-				roles.Add(grant.ProjectID, role, grant.ResourceOwner, grant.OrgPrimaryDomain, grant.ProjectID == projectID, grant.ProjectID == projectAud)
-			}
+			roles.Add(grant.ProjectID, role, grant.ResourceOwner, grant.OrgPrimaryDomain, grant.ProjectID == projectID)
 		}
 	}
 	return roles
 }
 
-func (p *projectsRoles) Add(projectID, roleKey, orgID, domain string, isRequested bool, isAudienceReq bool) {
+func (p *projectsRoles) Add(projectID, roleKey, orgID, domain string, isRequested bool) {
 	if p.projects == nil {
 		p.projects = make(map[string]projectRoles, 1)
 	}
@@ -142,12 +138,6 @@ func (p *projectsRoles) Add(projectID, roleKey, orgID, domain string, isRequeste
 	if isRequested {
 		p.requestProjectID = projectID
 	}
-	if p.requestAudIDs == nil {
-		p.requestAudIDs = make(map[string]struct{}, 1)
-	}
-	if isAudienceReq {
-		p.requestAudIDs[projectID] = struct{}{}
-	}
 	p.projects[projectID].Add(roleKey, orgID, domain)
 }