OIDC SecurityPolicy forces every time a token introspection, causing excessive load

*Description*:
We are using Envoy Gateway with a SecurityPolicy configured for OIDC authentication against Keycloak. The policy works in the sense that users can log in and access the protected application.

However, we noticed that every subsequent request (even with a valid session cookie) triggers a call to Keycloak’s token introspection endpoint.

This behaviour:

- Places unnecessary load on the OIDC provider.
- Makes the application unavailable if Keycloak is temporarily down (the page remains white/blank).
- Defeats the purpose of having a JWT that could be validated locally.

We suspect that the gateway is unable to perform OIDC Discovery (fetching the JWKS from /.well-known/openid-configuration) and therefore falls back to token introspection.

Within the same subdomain the cookies are present like

- AccessToken-7958d6f
- IdToken-7958d6f
- OauthExpires-7958d6f
- OauthHMAC-7958d6f
- RefreshToken-7958d6f

*Repro steps*:
- Add a example site like simple nginx container
- Add a IDP eg. Keycloak
- Add a client for this example with sessions length like 30 minutes
- Create a security policy see below
- Open the side
- Scale down the IDP
- Open the side again
- You get a 500 Error because envoy tries a token introspection

```
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: oidc
namespace: nicenamespace
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: example
oidc:
provider:
issuer: "https://auth.${envoy_external_domain}/realms/example"
clientID: "${envoy_clientID}"
clientSecret:
name: sso-oidc-secret
redirectURL: "https://example.${envoy_external_domain}/oauth2/callback"
```

*Environment*:
1.7.0 Envoy Gateway API

*Logs*:
N/A