Opaque token support is undocumented and untested

[Adrastopoulos]

Context

GrpcSecurity.oauth2ResourceServer() has supported opaque tokens since "Add some oauth2 configuration and sample code": OAuth2ResourceServerConfigurer.OpaqueTokenConfigurer exposes introspectionUri(), introspectionClientCredentials(), introspector() and authenticationConverter(), and builds an OpaqueTokenAuthenticationProvider.

None of that is visible to a user:

• the reference docs cover the OAuth2 resource server in one sentence and never mention opaqueToken()
• the grpc-oauth2 sample only demonstrates jwt(withDefaults())
• spring-grpc-core has no tests in the security package, so the extractors and the jwt()-over-opaqueToken() precedence in getAuthenticationProvider() are uncovered

Direction

• tests for BearerTokenAuthenticationExtractor, HttpBasicAuthenticationExtractor and OAuth2ResourceServerConfigurer, including the precedence rule
• an end-to-end test in the grpc-oauth2 sample that authenticates an opaque token against a Spring Authorization Server by introspection, mirroring the existing JWT test
• a docs section with worked jwt() and opaqueToken() examples, plus notes on introspector() / authenticationConverter()