Do not enforce UserInfo for OAuth2 if user prefers not to

[sberyozkin]

Fixes #52651.

OAuth2 login should work only with the authorization and token endpoint URLs if it is what the users want - to have an authenticated access and use the access token to access this provider's API.

With this PR I was able to import GitHub MCP Server using the OAuth2 option.

These 2 properties in a test

quarkus.oidc.github-no-id-token-no-user-info.authentication.verify-access-token=false
quarkus.oidc.github-no-id-token-no-user-info.token.verify-access-token-with-user-info=false

do not have be set generally, it just happens the github provider set in the test enables verify-access-token-with-user-info and the code flow access token is activated because JsonWebToken is injected in some resources

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 0d31abc.

Failing Jobs

Status	Name	Step	Failures	Logs	Raw logs	Build scan
✔️	JVM Tests - JDK 17			Logs	Raw logs	🔍
✔️	JVM Tests - JDK 21			Logs	Raw logs	🔍
✔️	JVM Tests - JDK 25			Logs	Raw logs	🔍
❌	JVM Tests - JDK 25 Semeru	Build	⚠️ Check →	Logs	Raw logs	🚧

You can consult the Develocity build scans.

[michalvavrik]

I thought about it a long while. I'd prefer if we were verifying a code flow to access token, but if user want to risk it fine. It would be nice if there was at least warning logged, or maybe there is warning logged on every request? Sorry, I had a long day so I didn't try it myself.