Check nonce re-usage prevention

[woutslakhorst]

In lots of OAuth2 protocol parts we need to check a nonce is used once. This is not done everywhere (yet)

[gerardsn]

this applies to other SessionStores too, like userRedirectStore and authzRequestObjectStore. Perhaps add a convenience function on the SessionStore interface that combines Get and Delete, or let Delete also return the value...

[woutslakhorst]

or let Delete also return the value...

sounds like a valuable addition

[gerardsn]

this consists of 2 parts

1. burn single use entries from local session storage after it has been used
2. temporarily store nonce/jti values received from other parties to prevent replay

The second is a bit harder since it requires going through all code/flows to see where these values are received.