Feature/reactive oauth2 token validator

[iain-henderson]

OAuth2TokenValidators are currently synchronous only. If a validator has an asynchronous dependency it cannot be used.

This PR updates NimbusReactiveJwtDecoder to utilize ReactiveOAuth2TokenValidator and adds a ReactiveWrappingOAuth2TokenValidator to facilitate using OAuth2TokenValidators in a reactive context.

[jgrandja]

@iain-henderson

You are right, when the OAuth2TokenValidator is called by NimbusReactiveJwtDecoder it will block the reactor event loop if the OAuth2TokenValidator performs a synchronous operation.

I'm actually very surprised that this is coming up just now given that NimbusReactiveJwtDecoder was introduced in 5.1. I guess it hasn't been an issue thus far.

Regardless, it is an issue that could happen. However, instead of introducing a new API, this can be solved quite easily by wrapping the validation in Mono.fromSupplier(supplier).subscribeOn(Schedulers.boundedElastic()). This pattern is already being used here:

spring-security/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/reactive/function/client/ServletOAuth2AuthorizedClientExchangeFilterFunction.java

Line 501 in 14d469c

// NOTE: 'authorizedClientManager.authorize()' needs to be executed on a dedicated

This would be the preference over introducing a new API and associated implementations.

[iain-henderson]

I think I have cleaned this up.
I was focused on enabling a reactive JwtValidator (our implementation uses a Mono to retrieve the signing key to verify the JWT), but I am glad that we can resolve a potential issue blocking on the wrong scheduler.