🔒 oidc: fix scope accumulation in loadExistingGrant

[douglasduteil]

Problem

addOIDCScope and addOIDCClaims are additive — scopes from prior
authorization requests (e.g. organization, siret) were retained on
the existing grant even when a subsequent request no longer included
them. This caused affiliation data (employer label, SIRET) to leak to
clients that no longer requested the organization scope.

Proposal

Always create a fresh grant so scopes/claims reflect exactly what the
current request asks for. The existing grant is still looked up, but
only to preserve its expiry and keep it aligned with the session TTL.

[rdubigny]

useful links:

• Skipping the Consent Dialog panva/node-oidc-provider#1307
• fix: skip_consent recipe causing "TypeError: Cannot read property 'ex… panva/node-oidc-provider#1202

[rdubigny]

@douglasduteil, I wanted to add tests for scenarios that were used to implement loadExistingGrant, but were not written down as tests at the time.

Scenario 1

The user is not prompted for consent:

• even if the prompt=consent parameter is sent;
• in a scenario where SP1 requests some scopes, then SP2 requests some other scopes.

Scenario 2

oidc-provider’s Grant expiration has no influence on oidc-provider’s Session still being active.

This issue is described here: panva/node-oidc-provider#1202