Access token validation potentially fails on XWiki 17.10.14+, 18.4.5+ and 18.8.0+ with "The provided encoded password doesn't match any known hash encoded password format"

Symptom

On some instances running XWiki 17.10.14+, 18.4.5+ or 18.8.0+, any request authenticated with an access token generated by the OIDC provider fails. For example, the userinfo endpoint answers with an HTTP 500 error page containing:

java.lang.IllegalArgumentException: The provided encoded password doesn't match any known hash encoded password format.

Since the error page is HTML, a client like Synapse (Matrix) fails to log in with a fetch_error (Expecting value: line 1 column 1 (char 0)).

Cause

BaseObjectOIDCConsent#isTokenValid validates the token with a default new PasswordClass() instead of the accessToken property defined in the consent class, so the check does not follow the configuration of that property. Since XWIKI-24357, PasswordClass throws an exception when the stored value does not match what it expects instead of silently falling back to another comparison.

Fix

Use the accessToken property of the consent class to validate the token, like BaseObjectOIDCClient already does for the client secret.