Support authenticating to OpenID Introspection endpoint

[sberyozkin]

Fixes #26796.

This PR supports a case where, according to #29796, introspection endpoint is protected by basic auth and a different client-id/client-secret combination than the usual combination used for authorization code flow and I believe it is not the first time I'm hearing about such a requirement.

PR itself is simple, it adds an option to configure quarkus.oidc.introspection-credentials.name and quarkus.oidc.introspection-credentials.secret (I just called the last one secret instead of password because we already have quarkus.oidc.credentials.secret for the usual client authentication). If the introspection credentials are configured and it is introspection then they will be sent as a basic auth scheme value. And finally the tests are modified to check that in one of the tests involving the introspection the the introspection credentials are indeed used to form a Basic Authentication scheme value.

@gastaldi Have a look please as Pedro may not be available right now. It is really only about adding one more (basic auth) way for Quarkus to authenticate to OpenId Connect provider, does not change anything with respect to the way OIDC flows are handled.

[gastaldi]

LGTM but it would be interesting to have something in the security guide about this

[sberyozkin]

@gastaldi Thanks, sure, I'll follow up with the minor update to the client authentication section now

[sberyozkin]

@gastaldi Updated the docs as well, thanks

[mqs24d]

@sberyozkin found a potential bug in the implementation :

OidcProviderClient#getHttpResponse

private UniOnItem<HttpResponse<Buffer>> getHttpResponse(String uri, MultiMap formBody, boolean introspect) {
        HttpRequest<Buffer> request = client.postAbs(uri);
        request.putHeader(CONTENT_TYPE_HEADER, APPLICATION_X_WWW_FORM_URLENCODED);
        request.putHeader(ACCEPT_HEADER, APPLICATION_JSON);
        if (introspect && introspectionBasicAuthScheme != null) {
            request.putHeader(AUTHORIZATION_HEADER, introspectionBasicAuthScheme);
            if (oidcConfig.clientId.isPresent()) {
                formBody.set(OidcConstants.CLIENT_ID, oidcConfig.clientId.get());
            }
        }

Imho the client_id which is set in line: formBody.set(OidcConstants.CLIENT_ID, oidcConfig.clientId.get()); Should be the one of the introspectionBasicAuthScheme (quarkus.oidc.introspection-credentials.name) or maybe don't set it at all?

The oidc server we need to use interprets the introspection credentials as separate client and therefore returns with a 401 if the client_id is set to the client_id which is used for the token/userinfo requests