Support unsigned ID tokens for OIDC

Describe the bug
Our attempt to certify our OIDC support with OpenID failed because Spring Security OIDC doesn't support unsigned ID tokens. As OIDC standard requires clients to support unsigned ID tokens I think Spring implementation shall allow them. It can be disallowed by default but it shall be possible to configure filter to support it.

BTW underlying Nimbus library allows unsigned ID tokens.

To Reproduce
Just point you sample or any other web application with OIDC filter to OpenID certification site and run the oidcc-client-test-idtoken-sig-none test.

BTW I think it is a good idea to certify every your release.

Expected behavior
It shall support unsigned ID tokens.

Sample

A link to a GitHub repository with a minimal, reproducible sample.

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

Start with the OIDC filter configuration and its Nimbus-backed ID-token validation path, then run the OpenID certification test oidcc-client-test-idtoken-sig-none. Done means unsigned ID tokens are accepted when explicitly configured while the default behavior remains disallowed.