feat: support plugin token

Instead of handing over access token, refresh token and ID token independently to the frontend, we now package them all into one Strapi OIDC token that contains the three.