Wrong KID in headers of ID Token for a Refresh Token

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Network project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

When requesting a refresh token we are seeing a case where the headers of the included id_token state one KID value, but in reality it is signed by a newer KID. This behavior occurs with refresh tokens that existed before we added a new keyset for "hydra.openid.id-token". I have been trying to parse through the source code, but I think the crux of the issues is KID is saved in the session and when a new keyset is added it is unaware. If this was a bug that you fixed in a newer version that would be great to know as well. I acknowledge that this may be user error on our part, but I can't figure out how it could be.

Reproducing the bug

For us the steps to reproduce are:

1. Go through an authcode flow and log in process that gives back an refresh token and id token
2. Add a new keyset for “hydra.openid.id-token”
3. Use the refresh token to get a new access token and id token
4. Inspect the id token and validate that the KID and signature do not work together

Relevant log output

No response

Relevant configuration

No response

Version

1.11.8

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Docker

Additional Context

No response

Start by tracing the refresh-token flow that creates the returned ID token, focusing on how the session's KID and the hydra.openid.id-token keyset are selected. Reproduce the authcode, keyset rotation, and refresh-token steps described in the issue, then verify that the ID token header KID corresponds to the key used for its signature.