Fix OIDC ID token exchange token type

[xfocus3]

Fixes gh-19448.

This maps OidcIdToken to urn:ietf:params:oauth:token-type:id_token when building token exchange request parameters. The default converter continues to use the existing fallback for other token classes.

Regression coverage checks OIDC ID tokens used as both subject_token and actor_token.

[shin1488]

The mapping is correct. The description is not.

"That correctly maps Jwt to urn:ietf:params:oauth:token-type:jwt" is the part gh-19436 (open, linked from gh-19448) disputes. RFC 8693 section 3 defines ...:jwt for sending a JWT to a different authorization server, and ...:access_token for a token issued by the authorization server being called — both arrive as a Jwt, so the Java type cannot tell them apart. The reference documentation's own token exchange example is the second case, where this mapping sends ...:jwt, and Ping (gh-16486) and Keycloak reject it.

defaultParameters() also calls tokenType() for actor_token_type, and convertWhenGrantRequestIsTokenExchangeThenParametersProvided in this file already asserts it for a Jwt actor token. The new test passes null as the actor token, so the OidcIdToken actor case — which this change also alters — is not covered.

gh-19436 has the rest: widening the mapping closes one identifier and leaves the application no more able to state one than before. gh-19076 is adding a resolver strategy for this same identifier on the authorization server side — this is the opposite shape on the client side. This PR does not close gh-19436.