feat: Adds Token Vault support

[kailash-b]

Description

This PR adds Token Vault (federated connection access token) retrieval to the SDK. It lets a web app obtain a third-party API access token (for a federated connection such as Google, GitHub, or Slack) for the logged-in user by exchanging the session's refresh token - without running a separate provider OAuth flow.

Public API added:

• HttpContext.GetAccessTokenForConnectionAsync(AccessTokenForConnectionRequest request, string? scheme = null) → Task<string?> — the caching entry point. Serves an unexpired cached connection token from the session, otherwise exchanges the refresh token and persists the result. Returns null (does not throw) when no refresh token is present or the exchange is rejected.
• AccessTokenForConnectionRequest — request type with Connection (required), LoginHint (optional, the provider-side IdP user ID), and ForceRefresh (bypass cache).

References

• Token Vault docs

Testing

New integration tests cover the load-bearing behaviors:

• TokenClientTests - the federated-connection grant sends byte-exact grant parameters (grant_type, subject_token_type, requested_token_type, subject_token, connection, optional login_hint), explicitly asserts no scope is sent, and surfaces failures as TokenRefreshResult.Failure.

• ConnectionTokenSetHelpersTests - find matches by connection only, upsert replaces (not duplicates) the same-connection entry, expired entries are pruned, and a single consistent timestamp is used for pruning and the new entry's expiry.

• HttpContextExtensionsTests - cache hit serves without a backchannel call; ForceRefresh bypasses the cache and persists the new token; missing refresh token fires OnMissingRefreshToken and returns null; a rejected exchange fires OnAccessTokenRefreshFailed and returns null.

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not main