Add Spring Authorization Server project: OAuth2/OIDC provider, client and resource server

Three modules on Spring Boot 4.1.1 with Spring Authorization Server 7.1.1: the provider
itself, a relying party, and an API that trusts its tokens. Client registration, PKCE,
a custom consent page and token customisation, with profiles that make each failure
reproducible.

Every claim is backed by captured output in docs/output/as-*.txt, regenerated by
authorization-server/scripts/run-all.sh. Notable findings, verified against the jars:

  - OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(HttpSecurity) was deleted
    in 7.0, and both configuration classes moved into spring-security-config
  - ClientSettings.requireProofKey flipped from false to true, on the authorization server
    (1.5.8 -> 7.1.1) and on the OAuth2 client (6.5.1 -> 7.1.1)
  - requireProofKey(false) does not make PKCE optional for a public client; the code
    verifier is that client's only authentication at the token endpoint
  - MediaTypeRequestMatcher(TEXT_HTML) matches Accept: */*, so the token endpoint answers
    API callers with 302 -> /login unless setIgnoredMediaTypes(ALL) is called

Also renames the repository to spring-auth-demo and cross-links the new chapter set from
the existing documentation.

docs/output/as-settings-defaults.txt

@@ -0,0 +1,32 @@
+# Defaults of ClientSettings.builder().build() and TokenSettings.builder().build(),
+# read out of the jars themselves rather than from documentation.
+# Source: tools/SettingsDefaults.java
+
+=== Spring Authorization Server 1.5.8 (last release of the standalone project) ===
+requireProofKey            = false
+requireAuthorizationConsent= false
+accessTokenTimeToLive      = PT5M
+accessTokenFormat          = self-contained
+refreshTokenTimeToLive     = PT1H
+reuseRefreshTokens         = true
+authorizationCodeTTL       = PT5M
+
+=== Spring Authorization Server 7.1.1 (inside Spring Security, Boot 4.1.1 BOM) ===
+requireProofKey            = true
+requireAuthorizationConsent= false
+accessTokenTimeToLive      = PT5M
+accessTokenFormat          = self-contained
+refreshTokenTimeToLive     = PT1H
+reuseRefreshTokens         = true
+authorizationCodeTTL       = PT5M
+
+# The same question on the CLIENT side. Source: tools/ClientPkceDefault.java
+
+=== spring-security-oauth2-client 6.5.1 ===
+ClientRegistration.ClientSettings.requireProofKey = false
+
+=== spring-security-oauth2-client 7.1.1 (Boot 4.1.1 BOM) ===
+ClientRegistration.ClientSettings.requireProofKey = true
+
+# Both sides flipped in the 7.x line. Spring-to-Spring therefore still works;
+# a 7.1 authorization server in front of a 6.x or hand-rolled client does not.