[OAuth2] Infrastructure for tracking token expiry time

Hi Hackers,

Currently, during OAuth2 authentication, the ValidatorModuleResult
structure allows a validator(extension) to return the authentication status
and the authn_id.
However, we ignore the token expiry time (exp claim).

Once a token is validated, the backend has no record of when that token
actually expires. A session can remain open indefinitely even if the
underlying access token has expired shortly after the connection was
established.

This patch adds the infrastructure to capture and store this expiration
timestamp within the backend session state. It does not implement an
enforcement policy (such as auto-termination).

Request a review.

Thanks & Best Regards,
Ajit