Improve JWT bearer usage - deprecate password grant

Why: password grant should be deprecated, because it is not part of newer OAuth or OIDC standards, e.g. https://oauth.net/2.1/
There is a RFC https://datatracker.ietf.org/doc/html/rfc9700#section-2.4 which states

The resource owner password credentials grant [[RFC6749](https://datatracker.ietf.org/doc/html/rfc6749)] MUST NOT be used.

For user interactive login or principal propagation we support the passcode login a way to omit passwords. For pure technical usages there is token based authentication with private_key_jwt (or later mtls) in client_credentials flows.

However, there are mixed scenarios, where technical scenarios need a user. Github action is a good example but there could be other scenarios, typically business scenarios, where a user principal propagation should be supported, but there is no user interactive login.

JWT bearer and generic token exchange can solve the problem, but in CF is it not easy to adopt JWT bearer and for the generic token exchange we have no support yet, e.g. https://www.rfc-editor.org/rfc/rfc8693.html .

This issue should collect and solve the problem, step by step.

Request a RFC from CF TOC https://github.com/cloudfoundry/community/pull/1085

No implementation files, tests, or entry points are named. Start by reading the linked OAuth 2.1, RFC 9700, and RFC 8693 material and the referenced Cloud Foundry RFC request; a useful outcome would require a defined, stepwise scope for JWT bearer or token exchange support and explicit completion criteria.