OIDC ID token should be verified before UserInfo is accessed with the access token

[sberyozkin]

Describe the bug

It is not really a bug as such but it is sub-optimal to start requesting UserInfo with the code flow access token if the ID token representing the user authentication is invalid, for example, it has expired, so the UserInfo remote call should not even go ahead in such a case.
And the OIDC certification test has flagged it as a bug.

Expected behavior

Simply change the order - instead of using the code flow access token to get UserInfo first and then verifying ID token, do it the other way around, verify ID token first, if all is good, proceed with the UserInfo acquisition if needed

Actual behavior

No response

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @pedroigor (oidc)