Enable token exchange for the example KC clients

[jhrozek]

Extends the keycloak setup script we have with settings to perform a token exchange of tokens with aud=mcp-servers for tokens with aud=backend. To test:

TOKEN=$(curl -s -d "client_id=mcp-test-client" -d "client_secret=mcp-test-client-secret" -d "username=toolhive-user" -d "password=user123" -d "grant_type=password" "http://localhost:8080/realms/toolhive/protocol/openid-connect/token" | jq -r '.access_token')

curl -s -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
        -d "client_id=mcp-server" \
        -d "client_secret=PLOs4j6ti521kb5ZVVwi5GWi9eDYTwq" \
        -d "subject_token=$TOKEN" \
        -d "subject_token_type=urn:ietf:params:oauth:token-type:access_token" \
        -d "scope=backend-access" \
        "http://localhost:8080/realms/toolhive/protocol/openid-connect/token"

Which gives you a token like:

{
  "exp": 1758154725,
  "iat": 1758151125,
  "jti": "ntrtte:3030a890-c9e7-65d6-8113-67758e5cbc22",
  "iss": "http://keycloak:8080/realms/toolhive",
  "aud": [
    "backend",
    "account"
  ],
  "sub": "3430d8ae-f15a-45cc-8bf0-6ab626312b59",
  "typ": "Bearer",
  "azp": "mcp-server",
  "sid": "10d002b5-c35a-4e90-8763-e96f6ef13eed",
  "acr": "1",
  "realm_access": {
    "roles": [
      "offline_access",
      "default-roles-toolhive",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "profile backend-access email",
  "email_verified": true,
  "name": "ToolHive User",
  "preferred_username": "toolhive-user",
  "given_name": "ToolHive",
  "family_name": "User",
  "email": "user@toolhive.example.com"
}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.71%. Comparing base (ac073e0) to head (e1aadd4).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1930      +/-   ##
==========================================
- Coverage   46.71%   46.71%   -0.01%     
==========================================
  Files         220      220              
  Lines       27378    27378              
==========================================
- Hits        12791    12789       -2     
- Misses      13615    13617       +2     
  Partials      972      972              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.