Optionally forward the browser session start time and sign-in provider to backends #327

Problem

Backends receive neither the session start time nor the sign-in provider for browser sessions. The provider scheme claim (urn:cratis:session:provider-scheme) and the ticket issue time are reserved and stripped before forwarding, and auth_time is only present after a fresh-authentication challenge on an OIDC provider. Applications that mix providers of different strength cannot apply per-provider business rules or show session age without tracking it themselves.

Per-provider session lifetimes (#326) already let AuthProxy enforce a shorter cap for weaker providers, so backends no longer need this to enforce session age. This issue covers the remaining case where the backend wants to know.

Proposal

• Per-service opt-in, off by default.
• Forward a protected session start (Unix seconds), stamped once at sign-in in a protected cookie property and unchanged by sliding renewal or token refresh. Use a distinct name, not auth_time, since auth_time means an AuthProxy-validated authentication time.
• Forward the provider name or scheme.
• Carry both inside the x-ms-client-principal envelope (and the signed forwarded-identity envelope) only; no new plain headers. Never take the values from provider claims.

Acceptance criteria

• Off by default, and forwarded output is byte-identical when off.
• When on, the session start equals the sign-in time and does not change on cookie renewal or token refresh.
• Provider claims or inbound headers with the same names cannot override the values; spoofed inbound copies are stripped (one spec per name).
• Works for OIDC and OAuth providers.
• Compatible with forwarded-identity signing (specs and docs updated).
• Documented with an example in the forwarded-identity documentation.

Status

State: Done
Branch: l113-327-session-forwarding (#339)
Scope: Opt-in forwarding of session start + sign-in provider inside principal envelopes; branch l113-327-session-forwarding
Plan: Per-service opt-in ForwardSessionContext. Session start stamped once at sign-in in a protected cookie property; when enabled, the proxy transform appends urn:cratis:session:started and urn:cratis:session:sign-in-provider (scheme) to the principal envelope, covered by existing signing. Both names are reserved and stripped from provider, bearer, invite and inbound sources.
Delivered: Nothing yet.
Remaining: To be confirmed.
Follow-ups: None.