LG-13139: Fix race condition with token verifier expired validity

[aduth]

🎫 Ticket

LG-13139

🛠 Summary of changes

Fixes an issue where a token may become invalid between the time it's initially validated and when the identity is referenced, since each independently triggers validation to run.

The proposed solution is to memoize the validity result, since the submission is not parameterized, so the result on an instance would not be expected to change after the initial validation call. Edit: After 93edf8f, updated to use the second of the two "Alternative solution"s presented below (see discussion).

Alternative solution could include: (I'm open to any of these)

• Removing the call to valid? within the identity method, since UserInfoController is the only place this class is used, and it's guaranteed by the controller code that identity would only be referenced on a valid result.
• Returning identity as part of the submission "result", i.e. FormResponse#extra, or as a tuple result [response, identity]

📜 Testing Plan

Validate that specs pass:

spec/controllers/openid_connect/user_info_controller_spec.rb

For good measure, sign-in end-to-end using the OIDC sample application.

[aduth]

A side benefit of this is it appears that previously the validations in AccessTokenValidator would have been run 4 times based on references to identity ([1], [2], [3], [4]). Now, validation is only run once.