Deprecate decode_id_token and stop validating ID tokens (#911) (#943)

* Deprecate decode_id_token and stop validating ID tokens (#911)

MSAL should not perform any ID token validation. Per OpenID Connect, an ID
token obtained via direct communication with the token endpoint (how MSAL
retrieves tokens) does not need client-side validation, and MSAL does not
manage sessions, so it should not check exp/iss/aud.

- Add non-validating _decode_id_token_claims() and use it on the retrieval
  path (Client._obtain_token and TokenCache) so no iss/aud/exp/nbf checks run
- Deprecate the public decode_id_token() function and Client.decode_id_token()
  method with a DeprecationWarning
- Keep nonce and max_age/auth_time auth-code-flow replay protections
- Update docstrings that claimed the SDK validates the ID token
- Update tests accordingly

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Clarify deprecation wording and add stacklevel to warning (PR #943 review)

- Add stacklevel=2 so the DeprecationWarning points at the caller's site
- Reword warning and docstrings to avoid implying this legacy helper is
  non-validating; clarify that only token acquisition stopped validating
  while decode_id_token() still performs legacy validation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>