Provide local validation of OAuth 2.0 JWT Access Tokens

[MartinFlores751]

Using the OAuth 2.0 Access Token JWT Profile¹, we should be able to validate access tokens for OpenID providers who give JWT access tokens but don't provide an introspection endpoint. This should cover most OpenID providers, though some providers may not provide either standard methods.

Footnotes

1. https://www.rfc-editor.org/rfc/rfc9068 ↩

[korydraughn]

Does this overlap with any existing OAuth issues?

[MartinFlores751]

Not from what I can tell. It's a bit adjacent to the validating tokens issue, though that's focused on our 'client mode'. This issue is focused on 'protected resource mode'.

[korydraughn]

Okay. Placing in the 0.5.0 milestone for now.

Can bump it if necessary.