Backchannel logout leaves older access tokens of the session valid #3947

Describe the bug

After a backchannel logout, the proxy keeps accepting access tokens of the logged out session if more than one token of that session is still valid, for example after a token refresh.

The proxy keeps one lookup record per subject and session. That record points to the cached claims of the last token the proxy has seen. A logout only removes the claims this record points to, so the claims of older tokens stay in the userinfo cache and are still served.

Steps to reproduce

1. Log in and send a request with access token A.
2. Refresh the token before A expires and send a request with the new token B. Both tokens have the same sid.
3. Log out at the IDP, so it sends a backchannel logout for the session.
4. Send a request with token A.

Expected behavior

The request with token A is rejected with 401.

Actual behavior

Token B is rejected, but token A is accepted until its cache entry expires.

Setup

Default OIDC settings of the proxy and an IDP that sends backchannel logouts. Reproduced on main with Keycloak 25.0.0 and 26.8.1, with the memory and the nats-js-kv cache store.

PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt
PROXY_OIDC_SKIP_USER_INFO=false

Additional context

Fix proposed in #3477.