Allow for setting re-authentication and inactivity timeout

### Is your feature request related to a problem?

To comply with authentication assurance levels as described in [NIST SP 800-63B](https://csrc.nist.gov/pubs/sp/800/63/b/4/final) I want to set the re-authentication and inactivity timeout. There is no good way to do this that I can see.

### Describe the solution you'd like

Either a global setting where I can configure re-authentication and inactivity timeout or a similar setting in (login) stages or a new re-authentication policy type.

### Describe alternatives that you've considered

The only way I can see how to do this currently is using a combination of session validity (in the user login stage), Authenticator last validation threshold and OIDC token validity. This solution is not ideal as it is complex and leaves some gaps.

### Additional context

_No response_