Add authorizationCustomizer pattern for OAuth2Authorization customization

[nikitanagar08]

Summary

Based on maintainer feedback from @jgrandja, this PR replaces the narrow OAuth2AuthorizedScopesMapper with a more general authorizationCustomizer pattern.

The new design uses Consumer<OAuth2XXX_AuthenticationContext> to customize the OAuth2Authorization.Builder before building, providing:

• Broader applicability: Not limited to scope filtering - can customize attributes, metadata, tokens, etc.
• Consistent pattern: Same pattern used across multiple authentication providers
• General abstraction: Aligns with the maintainer's vision for a general "Policy Decision" capability

Changes

Authentication Providers Updated

1. OAuth2AuthorizationCodeRequestAuthenticationProvider

   • Added setAuthorizationCustomizer(Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext>)
   • Customizer called before both authorization consent and authorization code persistence

2. OAuth2AuthorizationConsentAuthenticationProvider

   • Added setAuthorizationCustomizer(Consumer<OAuth2AuthorizationConsentAuthenticationContext>)
   • Customizer called before authorization update with consent

3. OAuth2ClientCredentialsAuthenticationProvider

   • Replaced setAuthorizedScopesMapper() with setAuthorizationCustomizer()
   • Customizer called before token generation and authorization persistence

Context Enhancements

Added getAuthorizationBuilder() and authorizationBuilder() methods to:

• OAuth2AuthorizationCodeRequestAuthenticationContext
• OAuth2AuthorizationConsentAuthenticationContext
• OAuth2ClientCredentialsAuthenticationContext

Files Changed

Deleted:

• OAuth2AuthorizedScopesMapper.java (narrow scope)
• OAuth2AuthorizedScopesContext.java (narrow scope)

Modified:

• 3 Authentication Providers
• 3 Authentication Contexts
• 3 Test Classes

Usage Example

@Bean
Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authorizationCustomizer() {
    return context -> {
        OAuth2Authorization.Builder builder = context.getAuthorizationBuilder();
        
        // Filter scopes based on user roles
        Set<String> filteredScopes = filterScopesByRole(
            builder.<Set<String>>get("authorizedScopes"),
            context.getPrincipal()
        );
        builder.authorizedScopes(filteredScopes);
        
        // Add custom metadata
        builder.attribute("tenantId", getTenantId(context.getPrincipal()));
    };
}

Motivation

This addresses issue #1504 by providing a general-purpose extension point for customizing OAuth2Authorization before persistence, enabling use cases such as:

• Role/tenant-based scope filtering
• Adding metadata from upstream authz servers
• Policy-based authorization decisions
• Any other authorization customization needs

Test plan

• setAuthorizationCustomizerWhenNullThenThrowIllegalArgumentException - verifies null check
• authenticateWhenCustomAuthorizationCustomizerThenUsed - verifies customizer is invoked
• All existing tests pass
• Checkstyle passes
• Code compiles successfully

Fixes gh-1504

Signed-off-by: Nikita Nagar permanayan84@gmail.com