Add Spring Authorization Server project: OAuth2/OIDC provider, client and resource server

Three modules on Spring Boot 4.1.1 with Spring Authorization Server 7.1.1: the provider
itself, a relying party, and an API that trusts its tokens. Client registration, PKCE,
a custom consent page and token customisation, with profiles that make each failure
reproducible.

Every claim is backed by captured output in docs/output/as-*.txt, regenerated by
authorization-server/scripts/run-all.sh. Notable findings, verified against the jars:

  - OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(HttpSecurity) was deleted
    in 7.0, and both configuration classes moved into spring-security-config
  - ClientSettings.requireProofKey flipped from false to true, on the authorization server
    (1.5.8 -> 7.1.1) and on the OAuth2 client (6.5.1 -> 7.1.1)
  - requireProofKey(false) does not make PKCE optional for a public client; the code
    verifier is that client's only authentication at the token endpoint
  - MediaTypeRequestMatcher(TEXT_HTML) matches Accept: */*, so the token endpoint answers
    API callers with 302 -> /login unless setIgnoredMediaTypes(ALL) is called

Also renames the repository to spring-auth-demo and cross-links the new chapter set from
the existing documentation.

docs/output/as-client-credentials.txt

@@ -0,0 +1,66 @@
+
+------------------------------------------------------------------
+== POST /oauth2/token   grant_type=client_credentials
+------------------------------------------------------------------
+$ curl -su demo-service:service-secret -d grant_type=client_credentials \
+       -d scope=orders.read http://localhost:9000/oauth2/token
+{
+    "access_token": "eyJraWQiOiIyNjJiZDU1MC0zNjU3LTQ2YzQtYmFmYy1jY2U0YzZmNGUwY2IiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJkZW1vLXNlcnZpY2UiLCJhdWQiOiJvcmRlcnMtYXBpIiwibmJmIjoxNzg3NTM4NzEzLCJzY29wZSI6WyJvcmRlcnMucmVhZCJdLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjkwMDAiLCJleHAiOjE3ODc1MzkzMTMsImlhdCI6MTc4NzUzODcxMywianRpIjoiYWZkMDFkNTYtMTlhYS00MDk1LWJjYmYtZGQxMjlmNGNlMTRkIiwidGVuYW50IjoiYWNtZSJ9.P63TpKkWrcqxnCTVtTw3XRlmWRromcCmrynK1k1vWM9SoXzAvT7Pu03-JtwrH8b3-Js2QylXGiP2cah2HZHwNNNlft0zpIwosNtIWxSEVI4K5_M5IgAALgCqlwXs3rIFRvXGY5IyPXDJNkUslHO2OMQqdonHO8JL1cSLLe6MQKcKPS9jc-byqaLHgyYtAhO7acCmKSvzmP1kTN6cE33FtEOlCg_9HHB6hwphl5e2Sbacc8wPZU8pyGBD02QymvlH0LUMC-b2F0pnGka0os1pYL6cVI48irvKK6hhty-l7CNOfhjKJRaGwMHf4SAoFT2TBmzAKArNrJY2o_zganeZEg",
+    "scope": "orders.read",
+    "token_type": "Bearer",
+    "expires_in": 599
+}
+
+------------------------------------------------------------------
+== JOSE header
+------------------------------------------------------------------
+{
+  "alg": "RS256",
+  "kid": "262bd550-3657-46c4-bafc-cce4c6f4e0cb"
+}
+
+------------------------------------------------------------------
+== Claims
+------------------------------------------------------------------
+{
+  "aud": "orders-api",
+  "exp": 1787539313,
+  "iat": 1787538713,
+  "iss": "http://localhost:9000",
+  "jti": "afd01d56-19aa-4095-bcbf-dd129f4ce14d",
+  "nbf": 1787538713,
+  "scope": [
+    "orders.read"
+  ],
+  "sub": "demo-service",
+  "tenant": "acme"
+}
+
+------------------------------------------------------------------
+== Wrong secret
+------------------------------------------------------------------
+$ curl -si -u demo-service:WRONG -d grant_type=client_credentials http://localhost:9000/oauth2/token
+HTTP/1.1 401
+{"error":"invalid_client"}
+------------------------------------------------------------------
+== A grant the client is not registered for
+------------------------------------------------------------------
+$ curl -si -u demo-service:service-secret -d grant_type=authorization_code -d code=x http://localhost:9000/oauth2/token
+HTTP/1.1 400
+{"error":"invalid_grant"}
+------------------------------------------------------------------
+== A scope the client is not registered for
+------------------------------------------------------------------
+$ curl -s -u demo-service:service-secret -d grant_type=client_credentials -d scope=orders.write http://localhost:9000/oauth2/token
+{"error":"invalid_scope"}
+
+------------------------------------------------------------------
+== Calling the resource server with the token
+------------------------------------------------------------------
+GET /public -> 200
+{"message":"no token required"}
+GET /api/orders -> 200
+{"orders":[{"total":"42.00","id":1}],"subject":"demo-service","clientId":null,"scopes":["orders.read"],"roles":null,"tenant":"acme","audience":["orders-api"]}
+GET /api/admin -> 403
+  WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
+