OAuth refactor: update session handling

[thekaveman]

Currently

• The user's selected flow is maintained in the session
• The users's verified claims are stored in the session - this is the only definition of this concept, and it is ill-defined at best! (What is the type? What are expected values?)
• We can ignore oauth_token since it will be removed as part of Refactor: IdG sign out to use client_id #2700 and is already refactored in cdt_identity

Refactor

• ClaimsResult is a dataclass structure produced by a parser class that encodes the algorithm and types more explicitly.
• The Session wrapper is used internally by cdt_identity, and as the interface to communicate configuration and results between cdt_identity and benefits.

Acceptance criteria

• Benefits configuration from the new models is used to initialize the cdt_identity Session wrapper
• Benefits session handling incorporates usage of the cdt_identity Session wrapper (.e.g for claims)