Introspect OAuth2 refresh tokens

RFC 7662 lets clients introspect any OAuth2 token, but the endpoint
only resolved access tokens. Look up refresh tokens too, honor the
optional token_type_hint to drive lookup order with a fallback to the
other table, and report revoked or expired refresh tokens as inactive.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

e2e/internal/testutil/oauth2.go

@@ -717,11 +717,24 @@ func OAuth2UserInfoRaw(
 func OAuth2Introspect(
 	c *Client,
 	clientID, clientSecret, token string,
+) (*OAuth2IntrospectResponse, *OAuth2HTTPResponse, error) {
+	return OAuth2IntrospectWithHint(c, clientID, clientSecret, token, "")
+}
+
+// OAuth2IntrospectWithHint introspects a token with an optional
+// token_type_hint per RFC 7662.
+func OAuth2IntrospectWithHint(
+	c *Client,
+	clientID, clientSecret, token, tokenTypeHint string,
 ) (*OAuth2IntrospectResponse, *OAuth2HTTPResponse, error) {
 	values := url.Values{
 		"token": {token},
 	}
 
+	if tokenTypeHint != "" {
+		values.Set("token_type_hint", tokenTypeHint)
+	}
+
 	raw, err := postFormWithBasicAuth(
 		c.HTTPClient(),
 		oauth2BaseURL(c)+"/introspect",