Add request validator for refresh token grant

[therepanic]

Recently, I needed to use custom logic for validation, but this was not possible without making changes to the current code. Here, I presented an interface strategy that can be replaced with a custom one via a setter if desired. This is described here: spring-projects/spring-authorization-server#1941, and also here #18018 (comment).

[jgrandja]

Thanks for the PR @therepanic. I'll review this after we release 7.0. In the meantime, when you have a moment, please add tests. Thank you.

[makcpopTwo]

Copying my thoughts from: #18018

My case: I have custom DPoP and refresh token mapping, so I need the ability to override the extraction of the thumbprint from the refresh token.

Currently, I would need to duplicate some common parts of the DPoP validation in my own code (retrieving the DPoP from the context/authentication, verifying DPoP and ClientAuthenticationMethod, parsing the JWT, computing the thumbprint, comparing thumbprints). All of these are quite standard procedures defined by the RFC, and I’d prefer not to duplicate this logic in my validator — I only need to specify how the thumbprint should be extracted from the authentication (i.e., the refresh token).

If I completely override the validator, I might miss some validation logic that could be added to it in the future.

If it would be helpful, I can reference the relevant RFC parts to clarify which parts of the code are standardized.