test: align OIDC test mocks with v0.8.6-rc1 upstream

After rebasing onto v0.8.6-rc1, the cherry-picked AuthService and
openIdJwtStrategy tests need updated fixtures to satisfy upstream
additions:

- AuthService.refreshOpenID.spec.js: mock CloudFront helpers added
  upstream (getCloudFrontConfig, parseCloudFrontCookieScope,
  setCloudFrontCookies, CLOUDFRONT_SCOPE_COOKIE) — returning empty
  values so tests take the cloudfront_disabled short-circuit path.
- openIdJwtStrategy.spec.js: add 'iss' claim to the session-refresh
  test payload so upstream's stricter isOpenIdIssuerAllowed check
  passes before reaching the refresh logic under test.

Author: busla

api/server/services/AuthService.refreshOpenID.spec.js

@@ -15,6 +15,10 @@ jest.mock('@librechat/api', () => ({
   math: jest.fn((val, fallback) => (val ? Number(val) : fallback)),
   shouldUseSecureCookie: jest.fn(() => false),
   resolveAppConfigForUser: jest.fn(async (_getAppConfig, _user) => ({})),
+  getCloudFrontConfig: jest.fn(() => undefined),
+  parseCloudFrontCookieScope: jest.fn(() => null),
+  setCloudFrontCookies: jest.fn(),
+  CLOUDFRONT_SCOPE_COOKIE: 'cf_scope',
 }));
 jest.mock('~/models', () => ({
   findUser: jest.fn(),

api/strategies/openIdJwtStrategy.spec.js

@@ -588,7 +588,12 @@ describe('openIdJwtStrategy – session refresh on empty session', () => {
     provider: 'openid',
   };
 
-  const payload = { sub: 'oidc-123', email: 'test@example.com', exp: 9999999999 };
+  const payload = {
+    sub: 'oidc-123',
+    email: 'test@example.com',
+    iss: 'https://issuer.example.com',
+    exp: 9999999999,
+  };
 
   beforeEach(() => {
     jest.clearAllMocks();