Check subject on unsigned / unencrypted response

[SamuelWei]

Currently the userinfo data is not checked for unsigned / unencrypted responses.
However the specs require a validation of the subject:

The sub (subject) Claim MUST always be returned in the UserInfo Response.

NOTE: Due to the possibility of token substitution attacks (see Section 16.11), the UserInfo Response is not guaranteed to be about the End-User identified by the sub (subject) element of the ID Token. The sub Claim in the UserInfo Response MUST be verified to exactly match the sub Claim in the ID Token; if they do not match, the UserInfo Response values MUST NOT be used.

https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse

List of common tasks a pull request require complete

• Changelog entry is added or the pull request don't alter library's functionality