[Keycloak-OID4VCI]: Add support for parsing and understanding authorization_details at the Token Endpoint

[forkimenjeckayang]

Summary

This PR implements support for parsing and understanding authorization_details parameter at the Token Endpoint for OpenID4VCI (OpenID for Verifiable Credential Issuance).

Implementation Includes:

1. Authorization Details Processing

• Added support for parsing authorization_details parameter in token requests
• Supports both credential_configuration_id and format-based authorization details
• Validates authorization details structure and prevents invalid combinations

2. Credential Identifier Generation

• Generates unique credential identifiers based on authorization details
• Format: {UUID}

3. Session-based Identifier Persistence

• Stores credential identifiers in user session notes for persistence
• Reuses identifiers for the same credential_configuration_id within the same session
• Generates different identifiers for different sessions (session isolation)
• Supports both PreAuthorizedCode and AuthorizationCode grant types

4. Response Enhancement

• Returns authorization_details in token responses with generated credential identifiers
• Maintains backward compatibility with existing token response format
• Includes proper validation and error handling

[stephane-segning]

Nice work. My remarks are mostly comments and worries.

• Response Structure and Compatibility

  • Downstream clients expecting the previous token response format may break if they can’t handle the new authorization_details field.
  • Future changes to the AuthorizationDetailResponse structure could cause incompatibility
  • => Include comprehensive API changelogs and documentation updates & ensure strong versioning and feature toggling if needed.

• Logical/Behavioral Regression

  • => Consider additional concurrency testing under load

• Code Maintainability & Extensibility

• Error Handling & Feedback

  • => Log internal context server-side, but give minimal info in the API response

• Input Validation & Parsing

  • => Use strict Jackson settings (fail on unknown, max depth/size)
  • => Consider adding a maximum array/object depth or length to avoid DoS attacks 🤔

[Ogenbertrand]

Permit me to continue with the review on monday, as my health doesn't allow me to continue with the review today.

[Awambeng]

Thanks for addressing the changes. I have two minor comments for you to take a look at

[Ogenbertrand]

I confirm that my changes has been resolve correctly, and i'll proceed by approving.
Thanks for the PR @forkimenjeckayang.