Add OAuth2AuthenticatedPrincipal

[jzheaux]

Oftentimes, an OAuth 2.0 token does not precisely represent a user. It'd be nice to have a domain object different from OAuth2User that represented the attributes and authorities tied to the token's principal.

For example, resource servers deal with JWTs and Opaque Tokens.

The JWT RFC states that the sub claim is (emphasis mine):

The "sub" (subject) claim identifies the principal that is the subject of the JWT.

And the Introspection RFC states that it is based off of JWT:

Subject of the token, as defined in JWT [RFC7519].

Given that both specs, then, refer to this as the principal, and that this principal would need to extend AuthenticatedPrincipal, then OAuth2AuthenticatedPrincipal is a reasonable name.