Social registration checks the id_token nonce for OAUTH providers #243

Problem

OAuthHttpClient.getProfile, which social registration and account linking use, checks the nonce of
any id_token the token endpoint returns, whatever the provider type:

jwtClaimSet = getClaims(jwtReconstruction, getJwtToken(tokenEndpointResponse));
checkNonce(jwtClaimSet, nonce);

(openidm-identity-provider/src/main/java/org/forgerock/openidm/idp/client/OAuthHttpClient.java:159-165).
getAuthToken, which login uses, checks the nonce only for OPENID_CONNECT (:211-216).

An OAUTH provider that returns an id_token without the request's nonce therefore passes login but
fails registration and account linking with 400 "Nonce provided does not match claim"
(checkNonce also fails when the claim is absent, :128-131).

LinkedIn is such a provider once #231 lands: its catalog entry is OAUTH with the openid scope
(needed for /v2/userinfo), so the token endpoint returns an id_token. Keycloak's LinkedIn OIDC
provider states that LinkedIn does not return the request nonce in the ID token and turns the check
off (LinkedInOIDCIdentityProviderFactory.java on keycloak main). Not verified against a
registered LinkedIn application.

Proposed fix

Check the nonce in getProfile only for OPENID_CONNECT, as getAuthToken already does:

jwtClaimSet = getClaims(jwtReconstruction, getJwtToken(tokenEndpointResponse));
if (OPENID_CONNECT.equals(config.getType())) {
    checkNonce(jwtClaimSet, nonce);
}

plus a unit test for both types.

Related

Raised in the review of #231 (non-blocking, follow-up).