feat: extend token exchange response

[muhlemmer]

This change adds fields to the token exchange and token claims types.

The act claim has been added to describe the actor in case of impersonation or delegation. An actor can be nested in case an obtained token is used as actor token to obtain impersonation or delegation. This allows creating a chain of actors. See RFC 8693, section 4.1. The invalid_target error has been added as per RFC requirements.

The id_token field has been added to the Token Exchange response so an ID Token can be returned along with an access token. This is not specified in RFC 8693, but it allows us be consistent with OpenID responses when the scope openid is set, while the requested token type may remain access token.

The token exchange client now also can use JWT Profile authentication, which was needed for integration tests in ZITADEL.

Related https://github.com/zitadel/zitadel/issues/7210

Definition of Ready

• [x] I am happy with the code
• [x] Short description of the feature/issue is added in the pr description
• [x] PR is linked to the corresponding user story
• [x] Acceptance criteria are met
• [x] All open todos and follow ups are defined in a new ticket and justified
• [x] Deviations from the acceptance criteria and design are agreed with the PO and documented.
• [x] No debug or dead code
• [x] My code has no repetitions
• [x] Critical parts are tested automatically
• [x] Where possible E2E tests are implemented
• [x] Documentation/examples are up-to-date
• [x] All non-functional requirements are met
• [x] Functionality of the acceptance criteria is checked manually on the dev system.

[github-actions[bot]]

:tada: This PR is included in version 3.15.0 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket: