Add ID token support for token exchange

[bkoragan]

I discussed this approach and received positive feedback. This PR implements the proposed design.

Summary

Add support for exchanging externally-issued OIDC ID tokens for access tokens via the OAuth 2.0 Token Exchange Grant per RFC 8693 - sec 3.

New classes:

• OAuth2TokenExchangeSubjectTokenResolver — strategy interface for resolving external subject tokens
• OAuth2TokenExchangeSubjectTokenContext — context object with resolved principal, claims, and scopes
• OidcIdTokenSubjectTokenResolver — default implementation using JwtDecoderFactory<RegisteredClient>

Modified classes:

• OAuth2TokenExchangeAuthenticationConverter — acceptid_token as supported token type
• OAuth2TokenExchangeAuthenticationProvider — delegate to resolver before falling back to authorization service
• OAuth2TokenEndpointConfigurer — auto-wire resolver bean

Design Decisions

• Provider stays final; only token resolution is pluggable
• Resolver returns null for unsupported types (chain-of-responsibility, same pattern as AuthenticationConverter)
• JwtDecoderFactory<RegisteredClient> follows the same pattern as JwtClientAssertionDecoderFactory
• Bean auto-wiring via getOptionalBean (same as OAuth2AuthorizationService, OAuth2TokenGenerator`)
• No breaking changes; existing behavior untouched when no resolver is configured.

Configuration Example

@Bean
OidcIdTokenSubjectTokenResolver subjectTokenResolver() {
    return new OidcIdTokenSubjectTokenResolver(
        (registeredClient) -> {
            String jwkSetUri = registeredClient
                .getClientSettings()
                .getSetting("id-token-jwk-set-uri");
            return NimbusJwtDecoder
                .withJwkSetUri(jwkSetUri).build();
        }
    );
}

**Scenarios tested - as standard alone:**

| # | Scenario | Result |
|---|----------|--------|
| 1 | Exchange valid ID token (self-signed) | 200 + access token with correct `sub` |
| 2 | Tampered/invalid ID token | 400 `invalid_grant` |
| 3 | Expired ID token | 400 `invalid_grant` |
| 4 | ID token without `sub` claim | 400 `invalid_grant` |
| 5 | Unsupported token type | 400 `unsupported_token_type` |
| 6 | Resolver returns null, fallback to authorizationService | Works as before |
| 7 | Client credentials grant (backward compatabele) | 200 (no change) |
| 8 | Multi-IdP routing (GitHub, Google issuers) | Correct issuer-based decoder selection |

[bkoragan]

@jgrandja Please review and share if any feedback. Note: reference to our proposal discussion :#19048 (comment)