support limiting session lifespan by the expiry of OpenID Connect identity tokens

Per the OpenID Connect Session Management draft spec section 4:

An ID Token typically comes with an expiration date. The RP MAY rely on it to expire the RP session. However, it is entirely possible that the End-User might have logged out of the OP before the expiration date. Therefore, it is highly desirable to be able to find out the login status of the End-User at the OP.

This could be read a few ways (see also the discussion in #6742 ):

• that the expiration date should be an upper bound on session lifespan, but other options to end the session sooner are provided in the session management spec
• that respecting the expiration date is optional entirely

Having support for limiting the session lifespan to the expiration of the identity token would be greatly appreciated. This is analogous to SAML2's sessionNotOnOrAfter in an AuthnStatement, in being a way for identity providers to set an upper bound for session duration in a connected application without verifying that the user's session is still active at the identity provider

Start with OpenID Connect Session Management draft section 4 and the discussion in issue #6742, since the issue does not name implementation files or tests. Clarify whether the identity token expiry is an upper bound or optional behavior, then identify the existing session-lifecycle entry points and define tests showing that the connected application's session is limited by token expiry.