Add Option to issue RFC9068 compliant access tokens

### Is your feature request related to a problem?

Since OAuth2 doesn't specify a specific format for access tokens, it is not trivial to verify access tokens from every provider without knowing the specific implementation used to issue access tokens without additional communication with the provider. Also, currently you can't be sure if a token that a relying party receives is actually an access token and not an id token. Therefor it would be great if every provider would use a standard for issuing access tokens, so it is easier to verify them.

### Describe the solution you'd like

To support a more straightforward approach for access token verification, I recommend adding support for issuing access tokens aligned with the proposal in RFC 9068.

As far as I understand the specification defined in RFC 9068 and the current functionality of Authentik, the following changes would be necessary to support an RFC 9068 compliant mode:
- changing the value of `typ` in the access token header to `at+jwt`
- changing the value of the `aud` claim to the intended recipients the token is for (maybe application slug) instead of the client id the token is issued with. This can either be a single string or an array of strings for multiple recipients
- adding a `client_id` claim with the client id the token was issued with

### Describe alternatives that you've considered

To verify if an RP receives an access token and not an id token, I currently check if the token contains a `scope` claim, although in theory an id token could also contain additional claims like the `scope` claim. Therefore, this approach is unreliable.

### Additional context

_No response_