PYSEC-2026-4357: Authlib OpenID Connect nonce validation bypass

Before version 1.9.0, Authlib’s OpenIDMixin.parse_id_token() reads the nonce_supported value from the ID token being validated. When the value is the JSON boolean false, nonce validation is skipped. This can allow an attacker to replay a captured, validly signed victim ID token into an attacker-controlled session. Plain authorization code flow is not affected.