feat: support on-behalf-of token exchange and additional parameters

[aidandaly24]

Summary

• Add ON_BEHALF_OF_TOKEN_EXCHANGE as a supported auth_flow value in the requires_access_token decorator
• Add resources and audiences optional parameters to the requires_access_token decorator
• Forward resources and audiences through to IdentityClient.get_token()

Related Issues

Mirrors private repo PR: https://github.com/aws/bedrock-agentcore-sdk-python-private/pull/108

Type of Change

New feature

Testing

• Unit tests added for all three auth flows (M2M, USER_FEDERATION, ON_BEHALF_OF_TOKEN_EXCHANGE)
• Tests verify resources/audiences are forwarded correctly
• Existing tests updated to assert new parameters

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• My changes generate no new warnings

Note: services/identity.py get_token() also needs updating to accept resources, audiences, and ON_BEHALF_OF_TOKEN_EXCHANGE in its type signature — see review comments on the private PR.

[github-actions]

✅ No Breaking Changes Detected

No public API breaking changes found in this PR.