Handle missing token exchange requested_token_type parameter

[ctriant]

According to OAuth 2.0 Token Exchange the requested_token_type of a Token Exchange request is optional. In the case where this parameter is missing from the request, a KeyError is raised.

To solve this issue, this MR introduces a mandatory configuration parameter default_requested_token_type for the TokenExchangeHelper configuration.

[ctriant]

Should we enforce that default_requested_token_type is a permitted token type according to requested_token_types_supported, or should we push the responsibility to the user? @rohe

[rohe]

Pushing responsibility to the user is almost never a good thing.