Allow cross provider oauth2 token introspection and restrict to confidential clients

[bcollet]

Closes: #11618

Details

Authentik's current implementation only allows for the introspection of tokens generated with the provider used to authenticate against the introspection endpoint.

This is an issue because the resource server is then required to use the same provider as the client and it prevents the use of multiple providers, each with their own client_id (let's say Thunderbird, Roundcube and mutt) to access a resource server (a Dovecot server for instance).

This PR removes the provider filter when retrieving introspection tokens.

Additionally to prevent token fishing from public applications it restricts the introspection endpoint to confidential clients

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)

[netlify]

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	0ac88b6
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/6700f6fdd0c75d000856987d

[netlify]

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	0ac88b6
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/6700f6fd5713960008152cda