Fix OIDC site-access policy UI

[chen21019]

Summary:

• Clear stale identities when switching OIDC access to unrestricted.
• Deduplicate OIDC principals and prefer stable backend error codes over generic transport errors.
• Bind the existing MFA confirmation dialog to the supplied purpose and request digest, with one bounded retry.
• Localize the policy errors and required-identity validation across all 13 shipped locales.
• Bump Web Console to 1.6.118 and align documentation and version gates.

Validation:

• Full Chrome 152 suite passed: 477 of 477.
• Focused site-access suite passed: 7 of 7 after the final error-precedence regression was added.
• Existing deterministic cross-tab race coverage remains in the full suite.
• Codex Security diff scan reported zero reportable findings.