Include a discovery parameter for optional OAuth 2.0 Token Introspection

[jmandel]

The SMART spec recommends (but doesn't require) that servers support dynamic registration, and includes a “register” discovery URL in the discovery protocol. Similarly, we should include an “introspect” discovery URL in the discovery protocol and recommend that EHRs support Oauth 2.0 Token Introspection. This enables a broad array of use cases where downstream parties want to understand the validity of a current token. For a major public implementation of this concept, see Google's https://developers.google.com/identity/sign-in/web/backend-auth#calling-the-tokeninfo-endpoint