feat(auth): Allow ForceIntrospection, pass optional Client ID/Secret on Introspect

[danielmustafa]

Description

1. Introduces new parameter forceIntrospection. Some identity providers require introspection on access_token validation (instead of the normal JWKS validation approach). If the value is true, will treat the incoming token as opaque and perform introspection validation. This is only enabled when mcpEnabled is true.
2. Introduces environment variables INTROSPECTION_CLIENT_ID and INTROSPECTION_CLIENT_SECRET. Some identity providers require a client id/secret to be set when performing introspection on an access token. If both environment variables are set, the logic will send Basic<client_id:client_secret> as the user/pass of the introspection request. If only one environment variable is populated, a warning log will be written.

PR Checklist

Thank you for opening a Pull Request! Before submitting your PR, there are a
few things you can do to make sure it goes smoothly:

• Make sure you reviewed
  CONTRIBUTING.md
• Make sure to open an issue as a
  bug/issue
  before writing your code! That way we can discuss the change, evaluate
  designs, and agree on the general idea
• Ensure you have manually reviewed the entire diff before requesting a
  review
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)
• Make sure to add ! if this involve a breaking change

🛠️ Fixes #<issue_number_goes_here>

[gemini-code-assist]

Code Review

This pull request introduces a forceIntrospection configuration option to the generic authentication service, allowing tokens to be validated via the introspection endpoint even if they are JWT-shaped. It also adds support for HTTP Basic Authentication on the introspection endpoint using environment variables. Feedback on these changes suggests refining the environment variable validation logic to prevent redundant warning logs when both variables are unset, and correcting a typo in a test function name.

[gemini-code-assist]

The current condition logs a warning even when both environment variables are empty (the default case). This will cause unnecessary warning logs on every startup for users who do not use introspection client authentication. We should only log a warning if exactly one of the environment variables is set.

if introspectionClientID == "" || introspectionClientSecret == "" {
		if (introspectionClientID == "") != (introspectionClientSecret == "") {
			log.Printf("WARNING: Only one of %s or %s is set. Both must be set to enable introspection client authentication.", IntrospectionClientIDEnvVar, IntrospectionClientSecretEnvVar)
		}
		introspectionClientID = ""
		introspectionClientSecret = ""
	}