Support automatic OAuth client-credentials token refresh

[chrisrentsman]

Summary

Adds support for Zendesk's OAuth client_credentials grant so a Zendesk client can mint and refresh short-lived access tokens instead of requiring a pre-minted OAuth token.

Addresses #829.

Changes

• Commit 1: Base implementation

  • Add HttpTokenMinter class for minting OAuth tokens, taking care to prevent credential leaks.
  • Add SharedFutureTokenProvider class for handling thread-safe token caching and refresh.
    • Refresh begins when the current token's remaining lifetime reaches a configurable threshold (50% by default).
    • One elected leader thread synchronously performs and publishes the refresh result.
    • While the cached token remains unexpired/usable, concurrent callers continue to use it rather than block.
    • If no usable cached token exists, concurrent callers await the result of the leader's in-flight mint attempt.
    • A failed proactive refresh is non-fatal so long as a usable cached token exists.
  • Inject the current bearer token when building requests.
  • Add Zendesk.Builder configuration.
  • Add Zendesk#warmUp() for clients who would like to mint the OAuth token ahead of the first request.
  • Surface token-minting failures through ZendeskOAuthException when no usable token remains.

• Commit 2: Add backoff on refresh failures

  • Add backoff logic in SharedFutureTokenProvider to suppress proactive mint attempts for 10 seconds after a failed mint attempt while a usable cached token remains.

Validation

• mvn verify using JDK 11.
• Stress-tested thread safety using a local custom harness with soak/herd tests and jcstress (not included in the PR).

References:

• Zendesk Documentation
• Zendesk Announcement

[Helmsdown]

@PierreBtz this is in reference to #829. (heh, Captain obvious here. I missed the reference that is clearly at the top of the PR description :-D )