Fixes #35482

Test already exists when the session cookie is well-formed but contains invalid tokens (401 is returned, the cookie is removed), but if the token is malformed then `500` escapes.

I've just added an `ArrayIndexOutOfBoundsException` catch block - as it may originate from several parts of the code parsing the token, and make sure the cookie is removed.
Minor updates to `OidcProvider` to make sure the error is correctly reported at the `CodeAuthenticationMechanism` level when the session cookie is well-formed but can not be verified.