Support oauth 2.0 token exchange (RFC 8693)

[HiranmayaGundu]

RFC 8693 implements an extension to oauth, implement a new flow with grant_type set to urn:ietf:params:oauth:grant-type:token-exchange to represent a token exchange. It would be nice for this to be one of the supported flows in the OpenAPI spec

[ralfhandl]

Seems we would need at least

• a new fixed field tokenExchange in the OAuth Flows Object
• the tokenUrl is required for this new flow
• the scopes are currently required for all flows, and may be empty, so that seems fine

Security expert advice needed!