Don't check the at_hash (access token hash) in OIDC ID Tokens if we don't use the access token

[anoadragon453]

It doesn't appear necessary to check this value if we don't end up actually using the data it refers to.

This was motivated by our work against the TI-Messenger spec. In our setup, we're receiving the ID Token from the upstream IdP, yet it has an invalid at_hash field. We're currently communicating with the IdP's maintainers as to why this is.

In the meantime, we've theorised that checking this field isn't actually necessary in our case. Synapse only uses the access token for fetching user metadata from a separate endpoint:

synapse/synapse/handlers/oidc.py

Lines 837 to 856 in b3099da

	async def _fetch_userinfo(self, token: Token) -> UserInfo:
	"""Fetch user information from the ``userinfo_endpoint``.
	Args:
	token: the token given by the ``token_endpoint``.
	Must include an ``access_token`` field.
	Returns:
	an object representing the user.
	"""
	logger.debug("Using the OAuth2 access_token to request userinfo")
	metadata = await self.load_metadata()
	resp = await self._http_client.request(
	"GET",
	metadata["userinfo_endpoint"],
	headers=Headers(
	{"Authorization": ["Bearer {}".format(token["access_token"])]}
	),
	)

But we don't do this in our setup, as all the user's metadata is included in the ID Token itself. Thus, we never actually use the access token, and it seems silly to validate it.

Currently we're working around this issue in our setup by stripping the at_hash field from the ID Token in a network proxy before Synapse receives it, but this seems like the cleaner solution.

FYI authlib is the one that actually validates this field, here. It only does so if the access_token parameter is set in the claims dict, which is what this PR is disabling when unnecessary.

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct
  (run the linters)

[anoadragon453]

@MadLittleMods I've added both a _uses_access_token property (good suggestion!) and a unit test. Please have another look.