pub fn decode_id_token(id_token: &str) -> Result<IdClaims>
Decode the middle segment of a JWT (no signature verification — we trust the channel the token came over, like every other MSAL-style client).