Review the claims in the JWT access token

Some claims (e.g. `auth_time`) exists in the ID token but not in the JWT access token. We want to review which claims we want to include in the JWT access token.

No files, tests, or entry points are named. Start by locating the code that assembles ID-token and JWT access-token claims, then review the expected claim set and relevant OIDC/JWT requirements; done means the desired differences are decided and reflected consistently in implementation and tests.

Written by the indexing model from the issue text.