Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

docs(oidc/client): state the limits of Secret and the persistence break

The documentation of oidcclient.Secret overstated its reach and left
out the runtime break of persisted values:

- encoding/gob refuses any value holding a Secret, so a gob-encoded
  session holding an Identity fails to save; YAML writes a Secret
  empty; documents persisted before the upgrade no longer decode.
  MIGRATION gives the rows and a struct-of-strings recipe.
- fmt prints a Secret it reaches through an unexported field as an
  address, not REDACTED, and a reflection dumper that dereferences
  pointers without calling methods (go-spew with DisableMethods, as in
  testify's failure diffs) prints its value; embedding a Secret makes
  the whole struct print REDACTED.
- AuthRequest.URL carries every request parameter in clear, the
  id_token_hint included: its renderings drop the query, its JSON
  hand-off does not. The renderings test now covers the hint.

The DefaultCapacity memory figure also counts acr_values.

Audit: F-11, I-14, D-12.