OIDC with JWT fails

*Description*:
I configured OIDC Authentication with Keycloak and JWT validation (group claim check). The setup works in the beginning as expected, but after a while the Cookie Header get's to big and all requests are blocked.

The cookie get's always to big when the Access Token is expiring after 5min. (default value for keycloak). Then I cann see a lot of cookies with the Name "OauthNonce-*" or "CodeVerifier*".

The fix for now is to delete the cookies and then I can work for around 5min. again.

*Repro steps*:
```YAML
# keycloak crossplane: https://github.com/crossplane-contrib/provider-keycloak
# prometheus client
apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: Client
metadata:
name: prometheus
spec:
deletionPolicy: Delete
forProvider:
# Enabled standard OAuth2 flow
standardFlowEnabled: true
accessType: confidential
realmId: ${REALM_NAME}
clientId: prometheus
rootUrl: "https://prometheus.${DOMAIN}"
webOrigins:
- "https://prometheus.${DOMAIN}"
validRedirectUris:
- "https://prometheus.${DOMAIN}/oauth2/callback"
validPostLogoutRedirectUris:
- "https://prometheus.${DOMAIN}/"
providerConfigRef:
name: keycloak-provider-config
writeConnectionSecretToRef:
name: prometheus-keycloak-secret
namespace: monitoring
---
# protocol mapper to add groups to access token
apiVersion: client.keycloak.crossplane.io/v1alpha1
kind: ProtocolMapper
metadata:
name: prometheus-oidc-group-membership-mapper
spec:
forProvider:
name: groups
realmId: ${REALM_NAME}
clientIdRef:
name: prometheus
#namespace: crossplane
protocol: openid-connect
protocolMapper: oidc-group-membership-mapper
config:
full.path: "false"
id.token.claim: "true"
access.token.claim: "true"
claim.name: groups
userinfo.token.claim: "true"
multivalued: "true"
providerConfigRef:
name: keycloak-provider-config
---
# SecurityPolicy for OIDC Authentication
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: prometheus-envoy-oidc
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: kube-prometheus-stack-prometheus
oidc:
provider:
issuer: "https://${KEYCLOAK_DOMAIN}/realms/${REALM_NAME}"
backendRefs:
- group: ""
kind: Service
name: keycloak-keycloakx-http
namespace: keycloak
port: 80
clientIDRef:
# transformation is needed, to match key client-id
name: "keycloak-oidc-client"
clientSecret:
# transformation is needed, to match key client-secret
name: "keycloak-oidc-client"
redirectURL: "https://prometheus.${DOMAIN}/oauth2/callback"
# needed that jwt can check claims
forwardAccessToken: true
# default is /logout
#logoutPath: "/logout"
cookieDomain: "${DOMAIN}"
jwt:
providers:
- name: keycloak
remoteJWKS:
failedRefetchDuration: 5s
uri: https://${KEYCLOAK_DOMAIN}/realms/${REALM_NAME}/protocol/openid-connect/certs
backendRefs:
- group: ""
kind: Service
name: keycloak-keycloakx-http
namespace: keycloak
port: 80
authorization:
defaultAction: Deny
rules:
- name: "allow-group"
action: Allow
principal:
jwt:
provider: keycloak
claims:
- name: groups
valueType: StringArray
values:
- prometheus-naj
---
# allow internal communication to keycloak
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
name: allow-envoy-gateway-to-keycloak
spec:
from:
- group: gateway.envoyproxy.io
kind: SecurityPolicy
namespace: monitoring
to:
- group: ""
kind: Service
name: keycloak-keycloakx-http
```

>**Note**: If there are privacy concerns, sanitize the data prior to
sharing.

*Environment*:
v1.9.0

Start by reproducing the OIDC flow from the SecurityPolicy and Keycloak configuration shown in the issue, focusing on cookie handling when the five-minute access token expires. Done means repeated token refreshes do not accumulate OauthNonce or CodeVerifier cookies, the Cookie header stays within limits, and requests continue to work without manually deleting cookies.

Written by the indexing model from the issue text.