Fix OIDC site-access policy updates

[chen21019]

Summary:

• Separate access-policy-only changes from OIDC identity-source initialization.
• Require fresh local recovery only for initial enablement, provider switches, and identity-source changes.
• Require an actor-, purpose-, and digest-bound one-time MFA confirmation for access expansion.
• Clear unrestricted allowlists, validate and deduplicate OIDC principals, and return stable error codes.
• Bump Authentication Service to v0.4.37 and align release documentation and gates.

Validation:

• go test ./... passed.
• Focused policy, persistence, discovery-suppression, stable-error, and bound-confirmation tests are included.
• Codex Security diff scan reported zero reportable findings.