This PR implements RFC9068 and fixes #427.

It implements:

• a token generator that builds JWT access tokens
• an introspection endpoint that introspects JWT access tokens
• a resource protector that validate authorizations against a JWT access token
• a revocation endpoint that refuses to revoke JWT access tokens

Everything is documented, and coverage is almost 100%, except on one part I will directly comment on the code.

I have left some comments for thing to be implemented with #524

Some notes about the implementation:

• resource protectors can take other arguments than scope, since RFC9068 introduces the groups, entitlements and roles claims to validate accesses
• register_endpoint can take objects, and not just classes
• I have not used joserfc yet. I thought it would be better to migrate the whole authlib library at once.