Add DPoP support to our AddLocalApi access token validation

[brockallen]

This PR attempts to preserve the existing handler and options and simply layers on the option to use DPoP.

Closes: #1261

[brockallen]

This does add some small breaking changes: The DPoP validation context used to have the Client and now instead that has been removed in favor of just properties with the expiration validation mode and clock skew properties. Also, the HTTP method and URL have been added to the context, whereas previously the validator assumed they were POST and the token endpoint.

Given that DPoP is still a fairly new feature and I don't expect many people to have overridden our validator, I don't anticipate this really affecting customers.