session property
Optional session snapshot. Consumers SHOULD include it so the producer can refresh
client-side state (acr changes after step-up, scope changes after policy edits, and
the session's absoluteExpiresAt) without a separate whoami call.
Implementation
final Session? session;