Backchannel logout has no lasting effect with PROXY_OIDC_SKIP_USER_INFO=true #3948

Describe the bug

With PROXY_OIDC_SKIP_USER_INFO=true, an access token is accepted again after a backchannel logout of its session.

The logout deletes the cached claims of the token. On the next request the proxy verifies the JWT again. The signature and the expiration are still valid, and with the userinfo lookup turned off the IDP is never asked, so the token is accepted and cached again. The same applies to tokens of the session that the proxy has not seen before the logout.

Steps to reproduce

1. Start the proxy with PROXY_OIDC_SKIP_USER_INFO=true.
2. Log in and send a request with access token A.
3. Log out at the IDP, so it sends a backchannel logout for the session.
4. Send a request with token A.

Expected behavior

The request is rejected with 401.

Actual behavior

The request is accepted, until the token expires.

Setup

Reproduced on main with Keycloak 25.0.0 and 26.8.1, with the memory and the nats-js-kv cache store.

PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt
PROXY_OIDC_SKIP_USER_INFO=true

Additional context

Fix proposed in #3477.