Detect clients which refresh their access tokens too early

[ahus1]

Description

Sometimes clients don't follow best practices to fresh their access token only when they are about to expire.
This creates a higher load on Keycloak than necessary.

Discussion

#14040 (comment)

Motivation

Administrators should have a simple way to detect this to investigate their clients.

Details

This can be done by storing additional information in events and providing an event listener which logs warnings if such a situation arises.

[daviddelannoy]

Hi @ahus1

Thanks a lot for this improvement. It will be very useful to detect and fix bad implementations like the ones that are guessed in issue #14040

[ahus1]

@daviddelannoy - thank you for your feedback. There is already a draft PR #28312, and I'd be happy to receive your feedback on the outlined behavior and design there.