Add email claim to Access Token oauth2

[Cantor, Scott]

> Because the application from a third party, that we are
> integrating with our OIDC OP, needs to get the email claim
> from the acessToken. Does it make sense? It should be like
> this?

The only case in which you would need the claim would be if that system you're logging into is then going to use the access token with a third system via an API that requires an OAuth token and will be verifying the JWT itself and wanting the claim (and email isn't the right information anyway, that's not an identifier).

If there are only two systems (OIDC client, OP) there is no scenario in which it's appropriate for that system to be looking at the access token, it's an opaque blob to any client.

-- Scott