[Security][SecurityBundle] Add IS_AUTHENTICATED_RECENTLY to require a fresh authentication - #66001

Sudo mode, asked for in #33955 seven years ago. The demand was never in question (@fabpot in 2022: "there are no questions about 'do we want it?'. It's more like, 'who wants to work on it?'"), but the issue was parked behind the broader "identity trust level" model in #39308, and both that issue and #30914 have since been closed without it. So this takes the self-contained route.

What it does

IS_AUTHENTICATED_FULLY describes how the session began, never how recently the user proved possession of their credentials. This adds a second axis:

#[IsGranted('IS_AUTHENTICATED_RECENTLY')]
public function deleteAccount(): Response

security:
    recent_authentication_lifetime: 900 # seconds, the default

Three pieces:

• AuthenticationTimeListener records the moment of an interactive authentication as the auth_time token attribute. auth_time is the name OIDC Core already uses for this, which keeps the door open for the ID token claim to feed the same stamp later.
• AuthenticatedVoter grants IS_AUTHENTICATED_RECENTLY while that stamp is within the configured lifetime.
• is_recently_authenticated() in the expression language and IsGrantedContext::isAuthenticatedRecently() for the closure form, matching the existing is_fully_authenticated() pair.

Design notes

• No BC break and no new storage. AbstractToken::__serialize() already includes $attributes, and ContextListener::refreshUser() mutates the token in place rather than rebuilding it, so the stamp survives the session round trip on its own. A functional test asserts exactly that rather than trusting it.
• Deliberately outside the granted hierarchy. IS_AUTHENTICATED_RECENTLY is strictly stronger than IS_AUTHENTICATED_FULLY, so being fully authenticated does not grant it. A token with no auth_time is denied, which is the safe default for non-interactive authenticators.
• Remember-me can never satisfy it. RememberMeAuthenticator::isInteractive() returns true, so a remember-me login does get stamped; the isFullFledged() guard is what keeps it denied. That is covered by a test, since it is the one place the feature could silently go wrong.
• This answers @stof's objection on the issue, that a shorter session lifetime might be enough. It is not: shortening the session changes when the session dies, not how recently the user authenticated within it.
• Clock is an optional injected service. Both the voter and the listener take a nullable Psr\Clock\ClockInterface, wired as service('clock')->nullOnInvalid(), which is the idiom FrameworkBundle itself uses at Resources/config/services.php:110 and web.php:66. clock is defined unconditionally by the DI kernel and aliased for both ClockInterface flavours, so a real application always gets it; the time() fallback only covers standalone use of the components, so neither package needs a new dependency. A functional test asserts the clock actually arrives, since nullOnInvalid() would otherwise let a wrong service id fall back to time() unnoticed.

Deliberately not in scope

• An entry point that turns a denial into a redirect to a re-authentication form, mirroring access_denied_handler. Worth doing, but it is a separate surface and this is already reviewable on its own.
• Feeding the OIDC auth_time claim into the same stamp, so max_age and sudo mode agree.

Docs to follow once the shape is agreed.

Thanks @javiereguiluz for the original RFC, and @stof and @wouterj for the constraints in the thread that shaped this.