Relevant to issue
Implement token introspection as per RFC-7662:
- introspection works on either access token or refresh token
- introspection only works for tokens from the provided client
Useful to allow third party services to check for token validity if the access token is not signed like a JWT