feat: implement legacy OAuth2 (OS-OAUTH2) compatible with Python Keystone

[gtema]

Description

Implement the legacy /v3/OS-OAUTH2/* endpoints to provide OAuth2 token exchange and introspection compatible with the Python Keystone legacy OAuth2 extension.

This is a secondary OAuth2 implementation, distinct from the native ADR 0026 OAuth2/OIDC Provider (#939). It is designed purely for compatibility with Python Keystone's legacy OS-OAUTH2 extension and is based on the application credentials mechanism rather than the native OAuth2/OIDC stack.

Background

Python Keystone's legacy OAuth2 (OS-OAUTH2) was an earlier compatibility layer that allowed third-party OAuth2 clients to exchange tokens without requiring full OAuth2/OIDC provider support. The current keystone-rs ADR 0026 implementation (#939) is a full, purpose-built OAuth2/OIDC provider. The legacy OS-OAUTH2 extension serves a different compatibility goal: it mimics the exact Python Keystone legacy behavior so that existing tooling and clients continue working.

Endpoints to implement

Endpoint	Actions
/v3/OS-OAUTH2/access_tokens	POST (token exchange), GET (introspection)
/v3/OS-OAUTH2/authorize	GET (authorization request)
/v3/OS-OAUTH2/resource_request	GET (resource validation)
/v3/OS-OAUTH2/requests	POST (create request), GET, PATCH, DELETE (request lifecycle)

Reference

• Python Keystone legacy OAuth2: openstack/keystone - oauth2
• Tempest legacy OAuth2 tests: tempest.api.identity.v3.test_os_oauth2_*

Notes

• This is not the ADR 0026 native OAuth2/OIDC provider
• Goal is behavioral compatibility with Python Keystone's legacy OS-OAUTH2
• Based on application credentials, not the native OAuth2 client model
• Tracked via the tempest skaffold module; re-run skaffold verify -m tempest -a build.artifacts -v debug to reproduce

Parent issue: #938 (Python API compatibility gaps - OAuth2 row)