Fixes accessTokenExpiresAt default value

- as per RFC the containing field is optional
- the accessTokenExpiresAt is not strictly required by our implementations as well
- so make it null in case it cannot be determined from server response

Fixes: SE-13502

src/main/java/sirius/web/security/oauth/ReceivedTokens.java

@@ -44,7 +44,8 @@ public static ReceivedTokens fromJson(ObjectNode response) {
         String refreshToken = response.required(OAuth.REFRESH_TOKEN).asText("");
         String type = response.required(OAuth.TOKEN_TYPE).asText("");
         long accessTokenExpiresIn = response.path(OAuth.EXPIRES_IN).asLong(0L);
-        LocalDateTime accessTokenExpiresAt = LocalDateTime.now().plusSeconds(accessTokenExpiresIn);
+        LocalDateTime accessTokenExpiresAt =
+                accessTokenExpiresIn > 0 ? LocalDateTime.now().plusSeconds(accessTokenExpiresIn) : null;
         if (OAuth.TOKEN_TYPE_BEARER.equalsIgnoreCase(type)) {
             try {
                 // Try to read the exact refresh token expiration date from the JWT token itself