Add rfc7662-compliant token introspection endpoint

[mike-marcacci]

Currently, a revocable token is passed as HTTP Basic credentials in the Authorization header. The authorization ID is used as the "username" and the authoriztion secret is used as the "password". For this to be possible, the authorization must include the scopes authx:authorization.equal.self.current:read.basic and authx:authorization.equal.self.current:read.scopes.

We need to consider a mechanism for supporting token introspection requests that follow rfc7662.

Currently, as there is no registration of resources, this isn't possible without deviating from the RFC's security recommendations.