Add utility endpoints for token consumers (resource servers)

Added /oauth/check_token (POST token=$TOKEN) and /oauth/token_key
for token decoding and (JWT only by default) token key sharing.
The check_token endpoint always requires client credentials and
Basic auth. The token_key endpoint requires client credentials
for a shared key and is open if the key is public. Even when
authenticated both endpoints are locked down (denyAll()) by
default and have to be unlocked by adding tokenKeyAccess()
or checkTokenAccess() to the AuthorizationServerSecurityConfigurer.

A side effect is a change to the configuration semantics. Formerly
apps could declare a @Bean of type TokenStore and not have to
explicitly add it to the AuthorizationServerEndpointsConfigurer.
Now it has to be added explicitly, unless as a bonus, the
AuthorizationServerEndpointsConfigurer has an explicit
AccessTokenConverter that is a JwtAccessTokenConverter, in
which case the JwtTokenStore is added automatically.