should set expires at for authorize code issued by hybrid flow

[nerocrux]

Related issue

• none

Proposed changes

• Should set authorize code's expires_at, which is issued by hybrid flow.

Checklist

• I have read the contributing guidelines
• I confirm that this pull request does not address a security vulnerability. If this pull request addresses a security
  vulnerability, I confirm that I got green light (please contact [email protected]) from the maintainers to push the changes.
• I signed the Developer's Certificate of Origin
  by signing my commit(s). You can amend your signature to the most recent commit by using git commit --amend -s. If you
  amend the commit, you might need to force push using git push --force HEAD:<branch>. Please be very careful when using
  force push.
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation within the code base (if appropriate)

Further comments

• Tested for hybrid flow with PCKE enabled (fixed by Permit response_type be "code id_token" #328).

[aeneasr]

Thank you!