Add shared OAuth constants and expose ExchangeConfig fields

[jhrozek]

Summary

This is preparatory refactoring for the XAA (Cross-Application Access) / ID-JAG work landing on top of this branch. It does two things together because the second depends on the first:

• Centralize OAuth URN constants. RFC 8693 token-type URNs and the token-exchange grant-type URN are used in multiple packages today, each duplicating the string literal. Move them into pkg/oauth (which already houses RFC 6749 grant types, RFC 7636 PKCE, RFC 7591 auth methods, and the well-known discovery paths) so follow-up work has a single place to reference them.
• Expose RequestedTokenType and Resource on ExchangeConfig. The private exchangeRequest struct has carried Resource since the original RFC 8693 implementation (Implement OAuth 2.0 Token Exchange (RFC 8693) support #2082), but there was no way for a caller to set it. Upcoming work (the XAA strategy) needs to override both fields. Additive; zero values preserve prior behavior.
• Enforce the Resource URI contract. The godoc already stated that Resource "Must be an absolute URI without a fragment" per RFC 8707 §2, but Validate() didn't enforce it. Now it does, so misconfigurations surface at config time instead of as opaque STS errors at runtime.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Primarily a constants-move refactor. The new ExchangeConfig fields are additive (zero values = prior behavior). The only actual behavior change is the new Resource URI validation, which rejects inputs that the godoc already prohibited.

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

New TestExchangeConfig_Validate_Resource covers 7 cases (empty, absolute https, absolute urn, relative path, scheme-less host, URI with fragment, malformed URI). New TestTokenSource_Token_RequestedTokenTypeAndResource covers wire-level propagation of both new fields (defaults, each field alone, both together). Existing tests pass unchanged.

Changes

File	Change
pkg/oauth/constants.go	Add TokenType{AccessToken,IDToken,JWT} and GrantTypeTokenExchange URN constants.
pkg/auth/tokenexchange/exchange.go	Drop four private URN constants in favour of oauth.* references; add RequestedTokenType and Resource to ExchangeConfig; enforce RFC 8707 §2 on Resource in Validate(); include Resource in the redacted String() output.
pkg/auth/tokenexchange/middleware.go	Update validation and godoc to reference the shared oauth.* constants.
pkg/auth/tokenexchange/exchange_test.go	Migrate existing assertions to the new constants; add two new tables (validation + wire propagation).
docs/server/{docs.go,swagger.json,swagger.yaml}	Regenerated to pick up the updated SubjectTokenType godoc wording.

Does this introduce a user-facing change?

No. The new ExchangeConfig fields are not yet surfaced through the middleware Config struct or any CRD, so they are only reachable by in-process callers that construct ExchangeConfig directly. Wiring through the higher-level config layers will land with the first consumer.

Special notes for reviewers

• The commit message mentions JWT-Bearer and ID-JAG URNs as a deliberate forward reference — those arrive with their first consumers in follow-up PRs on this stack, not here.
• RequestedTokenType is intentionally left as an open-ended string (no normalization). The XAA strategy in the follow-up stack sets it to urn:ietf:params:oauth:token-type:id-jag, which wouldn't survive a short-form allowlist check.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 94.11765% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.06%. Comparing base (a75ea2c) to head (550bbeb).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/auth/tokenexchange/exchange.go	92.85%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5003   +/-   ##
=======================================
  Coverage   69.05%   69.06%           
=======================================
  Files         554      554           
  Lines       73160    73176   +16     
=======================================
+ Hits        50521    50538   +17     
- Misses      19625    19627    +2     
+ Partials     3014     3011    -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.