Function generateIdToken

Generates a signed id_token JWT (OIDC 1.0 Core §2).

Claim composition:

• iss = issuer
• sub (required)
• aud (required)
• azp (optional, added when provided)
• exp / iat (seconds since epoch)
• auth_time (seconds since epoch, from authTime)
• sid (session identifier for back-channel logout)
• nonce (when provided by the authorize request)
• scope-filtered user claims via filterClaimsByScope

Header: typ: "JWT" (#394). Load-bearing, not a hint: logout's SF-1 check pins id_token_hint to the id_token typ, and every at+jwt-pinned surface (userinfo, introspection, the central verifier) relies on the value being disjoint from RFC 9068's at+jwt to refuse an id_token presented as an access token — a property JWT satisfies just as the pre-#394 id+jwt did, without failing strict external RPs that validate typ. Tokens minted before the flip carry id+jwt; the verifier accepts both during the migration window #402 closes.