feat: add sourcing secondary claims from access_token (#16517)

Niche edge case, assumes access_token is jwt. 

Some `access_token`s are JWT's with potential useful claims.
These claims would be nearly equivalent to `user_info` claims.
This is not apart of the oauth spec, so this feature should not be
loudly advertised. If using this feature, alternate solutions are preferred.

cli/testdata/server-config.yaml.golden

@@ -329,6 +329,12 @@ oidc:
   # Ignore the userinfo endpoint and only use the ID token for user information.
   # (default: false, type: bool)
   ignoreUserInfo: false
+  # Source supplemental user claims from the 'access_token'. This assumes the token
+  # is a jwt signed by the same issuer as the id_token. Using this requires setting
+  # 'oidc-ignore-userinfo' to true. This setting is not compliant with the OIDC
+  # specification and is not recommended. Use at your own risk.
+  # (default: false, type: bool)
+  accessTokenClaims: false
   # This field must be set if using the organization sync feature. Set to the claim
   # to be used for organizations.
   # (default: <unset>, type: string)