[Feature]: Support standard OIDC MFA claims (amr, acr, auth_time)

[alexlovelltroy]

Describe the feature

tokensmith should extract and propagate standard OIDC MFA claims from upstream identity providers to enable MFA-aware authorization policies.

Current Behavior:

• tokensmith's TSClaims struct already defines AMR, ACR, and AuthTime fields
• ExchangeToken() does NOT extract these from upstream OIDC tokens
• Custom NIST claims (auth_level, auth_factors, auth_methods) are required but don't align with standard OIDC

Desired Behavior:

• Extract amr (Authentication Methods Reference) from upstream id_token
• Extract acr (Authentication Context Class) from upstream id_token
• Extract auth_time from upstream id_token
• Map amr to AuthMethods for backward compatibility
• Derive AuthFactors by counting distinct factor categories in amr

Why do you want this feature?

Checking for MFA auth is required for several kinds of flows, most notably in wormhole

Alternatives you've considered

I considered doing...

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct