OpenID discovery, scopes and longer sessions

Added

• OpenID configuration and JWKS endpoints. An application can discover Identity's endpoints and fetch its public signing keys instead of having them configured by hand. Both answer cross-origin requests, so browser-based clients can read them directly.
• Signing algorithm per application. Tokens are signed with a private key and the algorithm recorded on the application, rather than one fixed choice for everyone.
• Scopes in the authorization request. Application verification accepts a scope parameter, so an application states what access it is asking for.
• Account history. Actions on applications, sessions and authorization requests are written to a history, so an account can show what happened and when.
• Push tokens on sign-in. Identifying a user now registers the device's push token alongside the issued token.
• Profile pictures. An account can carry a profile image.

Improved

• The authorization code flow follows the spec. The redirect back to the application carries both the authorization code and the state parameter it sent. The token exchange accepts form-encoded requests and answers clearly when a grant type is not supported.
• The user endpoint says more. It returns the user directly instead of wrapping it, includes the credentials assigned to that user, and validates the token more strictly before answering.
• Sign-ins last 90 days. Tokens stay valid for 90 days before a new sign-in is needed.
• Authorization ends with a confirmation. A completed authorization closes on a success animation.

Fixed

• Expired authorization chips were still accepted when a session was accepted. Expiry is now checked, and a request that is not allowed gets a clear answer instead of an ambiguous one.
• The app could stay stuck on a loading state when a request failed. It now stops and reports the failure.