Verify code flow access token first if no UserInfo precondition exists

[sberyozkin]

Fixes #30208.

This PR restores a correct order of the code flow access token verification when requesting UserInfo is not a prerequisite for verifying it.
Before 2.16.0.CR1 it was exactly the following order: 1) optionally verify code flow access token 2) get user info 3) verify id token - this works for the vast majority of cases - where the code flow access token can be verified either locally or via the introspection endpoint.
In 2.16.0.CR1, on my proposal, it was changed to 1) get user info 2) optionally verify code flow access token 3) verify id token, to support the indirect binary access token verification via the userinfo acquisition, for both the bearer and code flow access tokens - to support cases like GitHub returning binary access tokens, offering no public keys and no introspection endpoint but only allowing to use the access token to retrieve the user info, with GitHib performing itself an indirect access token verification.

But changing the order this way makes it impossible to fix #30208, since for the code flow access token to be refreshed before it can be used to acquire the userinfo it has to be verified first.

So this PR does the following:

• keep the order introduced in 2.16.0.CR1 only if the indirect binary access token verification is required to support GitHub and similar providers
• restores the pre-2.16.0.CR1 order for all other cases
• Improves the the pre-2.16.0.CR1 code flow access token verification code to check if it can be refreshed and does so the same way it can do it for ID token
• Also improves the remote introspection check a bit to support the token refreshment too
• adds a test: it checks that a code flow access token can be refreshed

[quarkus-bot]

Failing Jobs - Building f981645

Status	Name	Step	Failures	Logs	Raw logs
✖	JVM Tests - JDK 11	Download Maven Repo	⚠️ Check →	Logs	Raw logs
✖	JVM Tests - JDK 11 Windows	Download Maven Repo	⚠️ Check →	Logs	Raw logs
✔️	JVM Tests - JDK 17
✔️	JVM Tests - JDK 18

[sberyozkin]

Thanks @gastaldi, Pedro will only be avail early next week, so I'll merge as I'd like to get it to 2.16.0.Final is possible. @pedroigor Hey Pedro, ping me please anytime if you have any concerns re this PR - in a nutshell, apart from restoring the original order of the code flow access token verification, we also add here an option to refresh it same as you did awhile back for ID token