Support token-exchange after id_token received

[strehle]

Add 2 new commands

• jwt-bearer
• token-exchange

JWT bearer is working with existing id_tokens and return a new id_token

Token-Exchange from RFC 8693 is used for App2App in IAS and can be used to generate a ID or SAML token based on a token.

The API for token-exchange is documented in
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/configure-client-to-call-identity-authentication-token-exchange

New parameters combined with Docu:

• assertion -> subject_token
• subject_type -> subject_token_type ( only last part needed, access_token, id_token, refresh_token, jwt)
• requested_type -> requested_token_type ( only last part needed, access_token, id_token, saml2)
• provider_name -> resource parameter with provider name from https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/consume-apis-from-other-applications

Example:

openid-client -issuer https://<ias-host-name> -client_secret <ias-secret> -client_id <ias-client id> -requested_type saml2 -provider_name <name of API, e.g. SSO> -login_hint <user attribute>

With this call you get a browser windows opended, then

1. login (if corp.IdP is enable, login to corp.IdP)
2. IAS id-token created
3. SAML Bearer token is returned