Fixes #31691
Addresses #35225

As usual, the updates are based on 🦖 RexHacks!™ 🙈, so get ready for some potential code smells 💩👃😝 that we'll need to fix.

A couple of items to discuss for resolving this ...

• WRT getting the access token out of the cookie ...

  context.Properties.Items.Remove("access_token");

  That line doesn't seem to be removing the access token because the access token can still be obtained in ValidateOrRefreshCookieAsync, which is called after OnSigningIn. Is that the wrong way to remove the access token from the cookie? [It's on the PR in spite of being a no-op at the moment.]

• You suggested ...

  what we probably could do now is make the ServerWeatherForecaster inject the AuthenticationStateProvider rather than the IHttpContextAccessor since the access token is now in a claim and we no longer need access to the AuthenticationProperties from the HttpContext.

  When I injected AuthenticationStateProvider into the ServerWeatherForecaster and tried to use it ...

  internal sealed class ServerWeatherForecaster(IHttpClientFactory clientFactory, 
      AuthenticationStateProvider authStateProvider, IConfiguration config) : IWeatherForecaster
  {
      public async Task<IEnumerable<WeatherForecast>> GetWeatherForecastAsync()
      {
          ...
          var authState = await authStateProvider.GetAuthenticationStateAsync();
          var accessToken = authState.User.Claims.First(c => c.Type == "AccessToken").Value ?? 
              throw new Exception("No access token!");
          ...
  
          var response = await client.SendAsync(request);
  
          ...
      }
  }

  ... it throws when calling GetAuthenticationStateAsync stating ...

  System.InvalidOperationException: 'Do not call GetAuthenticationStateAsync outside of the DI scope for a Razor component. Typically, this means you can call it only within a Razor component or inside another DI service that is resolved for a Razor component.'

  Therefore, I went back to getting the claim from HttpContext, which is working 🎉 and on the PR.

Internal previews