Exchange token for Iceberg REST access

Exchange credentials for Open Source (OSS) Iceberg REST Client (IRC).

OSS IRC (< 1.10.x) uses 2 grant types:

• token-exchange: Defined by the OAuth 2.0 Token Exchange spec (RFC 8693). Exchange a valid, unexpired (OAuth) access token for a new access token with the same or smaller scopes.
• client_credentials: Defined by the OAuth 2.0 Authorization Framework spec (RFC 6749). Exchange a client credential (i.e. Wherobots API Key) for an access token.

Use cases:

1. [client_credentials] Users who has an API key yet no OAuth JWT token. Request format: { "grant_type": "client_credentials", "client_id": "<customer_id>", (Wherobots Customer Ext ID) "client_secret": "<api_key>", (Wherobots API Key) "scope": "<requested_scope>" ("catalog" for now, to be extended in the future) }
2. [token-exchange] Users who already has an valid, unexpired OAuth JWT token. Request format: { "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange", (OSS IRC always use this exact string) "scope": "<requested_scope>", "subject_token": "<current_unexpired_access_token>", "subject_token_type": "urn:ietf:params:oauth:token-type:access_token", (OSS IRC always use this exact string) "actor_token": "<optional_actor_token>", (not used currently) "actor_token_type": "<actor_token_type>" (not used currently) } Note: the optional actor_token is used for permission delegation, which is NOT currently supported, and thus has no effect even if provided. The "subject_token_type" has to be "access_token" at the moment - we currently only support exchanging access tokens.