Add documentation for custom OAuth2 client_credentials request fields

[pat-mccusker]

Closes gh-16605

While the process for adding these custom indicators is in retrospect pretty straightforward, it took me a bit of time to conceptually put it all together and so I thought it wouldn't hurt to add some documentation for it.

[jgrandja]

Thanks for the PR @pat-mccusker. However, it doesn't make sense to add this documentation and code sample for Resource Indicators for OAuth 2.0 given that the feature is not even implemented.

Feel free to add the full code sample to gh-16605. I'll leave the issue open for now but will close this PR.

As an FYI, I don't see Resource Indicators for OAuth 2.0 being supported anytime soon as it doesn't appear there is much demand for it and we have a number of higher priority items on our list for the major release of Spring Security 7.0 and Spring Authorization Server 2.0.

[pat-mccusker]

@jgrandja When you say the feature is not implemented, are you referring to specifically on the resource server side? I ask because its not being supported on the client side was my reasoning for adding the example.

I still think it's a valid use case as some may want to interact with some non-spring resource server that does act on the resource or audience request parameter and it might not be immediately obvious how this could be done with minimal additions to the existing client configuration.

[jgrandja]

@pat-mccusker

When you say the feature is not implemented, are you referring to specifically on the resource server side?

I'm referring to both resource server AND client side, as all OAuth2 flows involve at least the 2 parties and also the AS in other flows.

Either way, it's not supported on client and resource server side in Spring Security.

Furthermore, it's already documented on how to customize the authorization request or customize token request, which generally shows how one would add a custom parameter (e.g. resource or audience), and therefore I feel the PR adds more specific documentation but at the same time is a duplicate of what we already have.