Add support for OAuth 2.0 Protected Resource Metadata

[adutra]

We already have metadata discovery for Authorization Servers. It coud be interesting to add as well metadata discovery for Resource Servers that implement RFC 9728:

• Spec: https://datatracker.ietf.org/doc/rfc9728/
• Case study: https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protocol

However, no REST catalog server as of today implements RFC 9728.

[adutra]

Heads up: Quarkus 3.25 has introduced (minimal) support for RFC 9728:

https://quarkus.io/guides/security-oidc-expanded-configuration#resource-metadata-properties

Apace Polaris could leverage that:

apache/polaris#2581

[snazy]

Yea, this would be a great feature, reducing the amount of stuff that users have to configure.

But we'd need to define a way to tackle multi-tenancy. I think, it's the best option to go with the approach defined in the RFC, but we'll have to verify this, especially in reverse-proxy setups, which are common in k8s deployments.