Remove SDK-side ID token validation

[Copilot]

The SDK was validating ID token claims during decode and auth code flows. This change makes ID token handling decode-only so the library no longer enforces issuer, audience, nonce, time, or auth_time checks.

• Decode-only ID token handling

  • msal.oauth2cli.oidc.decode_id_token() now only parses and returns claims
  • legacy validation-related parameters are retained for compatibility but ignored

• Removed OIDC claim validation paths

  • removed issuer/audience/nonce/expiry/not-before checks from OIDC decoding
  • removed auth code flow nonce and max_age/auth_time validation tied to ID tokens
  • OIDC helpers continue returning id_token_claims without rejecting tokens based on claim contents

• Token cache alignment

  • token cache fallback decoding now uses raw claim decoding only
  • avoids reintroducing validation when extracting account metadata from id_token

• API/docs clarification

  • updated docstrings to reflect that nonce/claim validation is no longer performed by the SDK
  • clarified that callers who require validation must do it themselves

Example:

claims = oauth2cli.oidc.decode_id_token(
    id_token,
    client_id="expected-client",
    issuer="https://issuer.example",
    nonce="expected-nonce",
)

# Before: could raise on audience / issuer / nonce / time checks
# Now: returns decoded claims without SDK-side validation
print(claims["sub"])