feat: implement legacy OS-OAUTH2 extension (Python Keystone-compatible OAuth2 on top of application credentials)

[gtema]

Description

Implement the legacy /v3/OS-OAUTH2/* extension API for compatibility with Python Keystone.

This is a dedicated sub-issue of #938 (Python API compatibility gaps).

Important distinction

This is a secondary OAuth2 implementation separate from the native OAuth2/OIDC provider defined in ADR 0026 (#939). It is:

• A compatibility shim to match Python Keystone's OS-OAUTH2 extension API
• Based on application credentials: uses the existing application credentials mechanism as the underlying token infrastructure
• Python Keystone compatible: aims at behavioral parity with the legacy OS-OAUTH2 endpoints in Python Keystone\s keystone.token.providers.oauth1 / keystone.oslo.oauth2 modules
• Not a replacement for the authoritative OAuth2/OIDC provider (ADR 0026)

Endpoints

Category	Endpoint	Actions
OS-OAUTH2 Tokens	/v3/OS-OAUTH2/access_tokens	POST (create), GET (list)
OS-OAUTH2 Token	/v3/OS-OAUTH2/access_tokens/{id}	GET (show), DELETE
OS-OAUTH2 Refresh Token	/v3/OS-OAUTH2/refresh_tokens	POST (create)
OS-OAUTH2 Authorization Requests	/v3/OS-OAUTH2/authorization_requests	POST (create)
OS-OAUTH2 Authorization Request	/v3/OS-OAUTH2/authorization_requests/{id}	GET (show), PATCH (update), DELETE
OS-OAUTH2 Introspect	/v3/OS-OAUTH2/introspect	POST
OS-OAUTH2 Trusts (legacy)	/v3/OS-OAUTH2/trusts	POST

Reference

• Issue Python API compatibility gaps #938 (umbrella - Python API compatibility gaps)
• Issue Implement ADR 0026 - making keystone oauth2 OP #939 (AD