Replace usage of Feide Legacy OAuth `userinfo` endpoint

[mon4ssi]

Feide has deprecated the Legacy OAuth Userinfo Endpoint described at: https://docs.feide.no/reference/apis/deprecated/legacy_userinfo.html

This endpoint is part of their old OAuth 2.0 API and is no longer recommended for integration. The legacy /oauth/userinfo endpoint will be shut down in the future, and Feide strongly advises migrating to the OpenID Connect (OIDC) UserInfo endpoint.

Impact:
Our current integration still calls this legacy endpoint to retrieve authenticated user profile data. Continued use poses the following risks:

• Future breakage: Once Feide removes support, authentication-dependent features will fail.
• Security concerns: The legacy implementation does not align with current OAuth 2.0 and OIDC best practices.
• Maintenance burden: Using outdated APIs increases technical debt.

Required Changes:

1. Identify all code locations where the legacy endpoint is used.
2. Replace calls to the legacy endpoint with requests to the OIDC-compliant userinfo endpoint.
   • Documentation: OIDC UserInfo Endpoint
3. Update authentication scopes to match OIDC requirements.
4. Test the new flow to ensure user attributes are retrieved as expected.
5. Remove any code paths relying on legacy OAuth-only attributes.

References:

• Feide Deprecation Notice: Legacy Userinfo API
• OIDC UserInfo API: OIDC UserInfo API

Acceptance Criteria:

• All calls to the legacy /oauth/userinfo endpoint are removed.
• New implementation uses the OIDC /userinfo endpoint.
• Authentication and authorization flow fully validated.
• Unit/integration tests updated.

[atymic]

Feel free to PR