mod_http_oauth2: Only issue id_token when granted openid scope OpenID Connect Core 1.0 states that OIDC is only being done if the "openid" scope is included. https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1 Less details given out by default is good for privacy and byte count.

<tr>
  <th>What is {x} {op} {y}?</th><td>
    <input name="captcha_challenge" type="hidden" value="{challenge}">
    <input name="captcha_reply" pattern="[0-9]+" required type="number">
  </td></tr>