feat: add access token exchange and generic subject token type to Tok…

[kailash-b]

Changes

This PR extends the Token Vault token-exchange support in AuthAPI so callers can exchange access tokens (not just refresh tokens) for a federated identity provider's access token, and can specify an arbitrary subject token type when needed.

Method changes on com.auth0.client.auth.AuthAPI:

• Changed (signature): getTokenForConnection(String connection, String subjectToken, String subjectTokenType, String loginHint) is now the generic entry point. The caller supplies both the subjectToken and its subjectTokenType (e.g. urn:ietf:params:oauth:token-type:refresh_token or urn:ietf:params:oauth:token-type:access_token), so no assumption is made about which kind of token is being exchanged.
• Added: getTokenForConnectionWithRefreshToken(String connection, String refreshToken, String loginHint) — convenience method that delegates to the generic method with the refresh-token subject type.
• Added: getTokenForConnectionWithAccessToken(String connection, String accessToken, String loginHint) — convenience method that delegates with the access-token subject type.
• Deprecated: the previous getTokenForConnection(String connection, String refreshToken, String loginHint) 3-argument overload. It now delegates to getTokenForConnectionWithRefreshToken(...) for backward compatibility. Callers should migrate to the new convenience methods, or to the 4-argument generic method for full control.

All methods use the Token Vault grant urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token. The connection must have Token Vault enabled, and client authentication (client secret or client assertion) is required since this must be a private client.

Usage:

AuthAPI auth = AuthAPI.newBuilder("{DOMAIN}", "{CLIENT_ID}", "{CLIENT_SECRET}").build();

// Exchange a refresh token
TokenHolder result = auth.getTokenForConnectionWithRefreshToken("google-oauth2", refreshToken, null)
    .execute().getBody();

// Exchange an access token
TokenHolder result = auth.getTokenForConnectionWithAccessToken("google-oauth2", accessToken, null)
    .execute().getBody();

// Full control over subject token type
TokenHolder result = auth.getTokenForConnection(
        "google-oauth2", subjectToken, "urn:ietf:params:oauth:token-type:refresh_token", loginHint)
    .execute().getBody();

References

Testing

Unit tests were added in AuthAPITest covering the new access-token and generic token-type exchange paths, the new convenience methods, the deprecated overload's delegation, and null-argument assertions.

• This change adds test coverage
• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors