Optional support for the OIDC session cookie dir encryption

[sberyozkin]

Fixes #37785.

This PR adds an option to customize the way the session cookie is encrypted - it will continue using the current mode by default where a content encryption key (CEK) is generated (with more algorithms added as required - I'm not too keen to open it up completely to support all of them) - this mode is strongest but also produces a longer sequence and is a bit slower.

Direct dir encryption is a standard JWE option where the configured encryption key acts as CEK.

FYI, difference in the cookie size, in the 2 updated tests is 2919 (dir) vs 3043 (CEK is generated and encoded) so it is about 120 bytes which might make a difference.

[sberyozkin]

Hi Pedro @pedroigor, after looking at the issues related to the session token management, I think it makes sense to go ahead with this option, as it looks like that the OIDC session cookies, nearly all of them, are close to 4K by default, so having an option to shorten the cipher text, without having to split the session cookie length is useful.
I'll resolve the conflict and will ping you to discuss

[sberyozkin]

@pedroigor The reason it will make a difference is that I've noticed that with the max cookie value set to 4048 is not enough to avoid the split which is not great, so I've tuned it to 4056 for now, but with this option, decreasing the cookie size by 120 bytes on average will make the split unnecessary in many cases

[pedroigor]

LGTM

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 15d61a5.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

[sberyozkin]

Thanks @pedroigor, it should help Keycloak users in particular and those work work with providers like Azure which can produce massive ID tokens, to avoid splitting the cookies. I'll consider making it a default option if a strong encryption key is available, but for now the CEK will be generated which produces varying sequences for the same text.