Make ID token lifetimes configurable on OIDCClient resources

deploy/supervisor/config.supervisor.pinniped.dev_oidcclients.yaml

@@ -119,6 +119,27 @@ spec:
                 minItems: 1
                 type: array
                 x-kubernetes-list-type: set
+              tokenLifetimes:
+                description: tokenLifetimes are the optional overrides of token lifetimes
+                  for an OIDCClient.
+                properties:
+                  idTokenSeconds:
+                    description: |-
+                      idTokenSeconds is the lifetime of ID tokens issued to this client, in seconds. This will choose the lifetime of
+                      ID tokens returned by the authorization flow and the refresh grant. It will not influence the lifetime of the ID
+                      tokens returned by RFC8693 token exchange. When null, a short-lived default value will be used.
+                      This value must be between 120 and 1,800 seconds (30 minutes), inclusive. It is recommended to make these tokens
+                      short-lived to force the client to perform the refresh grant often, because the refresh grant will check with the
+                      external identity provider to decide if it is acceptable for the end user to continue their session, and will
+                      update the end user's group memberships from the external identity provider. Giving these tokens a long life is
+                      will allow the end user to continue to use a token while avoiding these updates from the external identity
+                      provider. However, some web applications may have reasons specific to the design of that application to prefer
+                      longer lifetimes.
+                    format: int32
+                    maximum: 1800
+                    minimum: 120
+                    type: integer
+                type: object
             required:
             - allowedGrantTypes
             - allowedRedirectURIs