[Security] Log the access tokens rejected by OidcTokenHandler at the debug level - #66710

OidcTokenHandler logs every token it rejects at the error level, with the stack trace. An expired token, a wrong audience or a bad signature is a client mistake that ends in a 401, and AuthenticatorManager already logs it as "Authenticator failed." at the info level. With the Monolog recipe (fingers_crossed, action_level: error), each expired token flushes the whole log buffer of the request.

This logs these rejections at the debug level, as DpopSenderConstraint does for a refused proof. The same goes for a token that cannot be decrypted when encryption is required, since a client sending a plain token there is the same kind of mistake. Errors while fetching the discovery document or the JWKS keep the error level, since they happen in computeDiscoveryKeys(), outside of this catch block.

A wrong key or a stale JWKS also shows up as a bad signature, so after this change it is only visible at the debug level and as "Authenticator failed." at info. The handler cannot tell it apart from a forged token.

I sent this to 8.2 because it changes the log level of existing code, like #66391 and #53201.

The tests that expected one error call now expect none, and a new test covers a plain token sent when encryption is required. They fail on 8.2 and pass with the change. ./phpunit src/Symfony/Component/Security/Http: OK, 1523 tests, 15 skipped.