OAuth Token Exchange (External/3rd Party Tokens)

As a user from an external system, I want to exchange my existing token for a ZITADEL token, So that I can access and use applications secured by ZITADEL without needing to log in again.

Description

This user story addresses the scenario where a user is already authenticated with an external identity provider (IdP) that is not ZITADEL. To enable seamless access to applications managed by ZITADEL, the user needs a mechanism to exchange their existing, trusted token from the external IdP for a new token issued by ZITADEL. This process, known as external token exchange, allows the user to be recognized and authorized within the ZITADEL ecosystem based on their existing authentication. This is crucial for integrations in embedded SDKs in (mobile) apps or web applications inside 3rd party applications, where the user authenticates the app using some 3rd party provider and the SDK needs to be able to get some sort of security token of ZITADEL (e.g. access_token) to call its backend

Acceptance Criteria

• token endpoint is extended with the rfc8693
• It is only allowed to impersonate for projects that have enabled impersonation #7209
• Token endpoint documentation is extended
• Guide for impersonation is written

Additional Information https://datatracker.ietf.org/doc/html/rfc8693#section-2.1

requires #7212 to be done first