Access token response, Token Introspection properties aren't quite right

[jmandel]

The access token response (and introspection response) from the launcher has some extra properties like:

• "val_method":"cc-asym"
• "jwks":"{\...

these shouldn't be there; the fix is to store them outside of the "context" param of our signed authorization code, since all context is merged into the access token response.

The token introspection response is missing the fhirUser property (taken from the id_token); this may have gotten lost in a feature branch merge, and should be detected by tests.