[Security] Add Token Service

[ginaxu1]

Current Limitation

Security Risks:

1. Passing appToken through system
2. Missing userToken in Consumer Application validation
3. No auth validation for OE -> PDP and OE -> CE

Suggested Improvement

RESEARCH FIRST

For now: create SecureTokenInterface with a test client that OE can use; create a generic payload that can be signed

Ideal Flow:

1. When a request comes to OE with appToken and userToken
2. The token service will look up clientID to get appID; and mint a token containing all information (appToken, userToken, audience, etc) --> this secure token will be used within OpenDIF system

Version

No response

Additional Context

No response