Including the RFC-7662 (token introspection)

Adding token introspection (RFC-7662) would be great!

We are using an API gateway with oauth2 introspection, in which the API gateway will query the oauth2 server to query if a token is still valid and for what user the token will be. Then the API gateway will handle API's based on user-data but only if the introspection succeeds.

A discussion is also opened on [stackoverflow](https://stackoverflow.com/questions/50320490/implement-rfc-7662-token-introspection-with-oauth2orize)

No source file, test, or entry point is named. Start by reviewing the RFC-7662 requirement and the linked Stack Overflow discussion, then trace how this OAuth 2.0 authorization server handles token validation and user data. Done means the toolkit supports introspection responses that let an API gateway determine whether a token is valid and identify its user.

Written by the indexing model from the issue text.