[SPIKE] HSP: Evaluate Support for HSP Auth Token

Description

For integration with HSP, they offer an authentication token that we can get in the frontend.

As outlined below, we have two options for using this token in our openMCP systems.
This spike should investigate the Token Exchange approach, in which our BFF would exchange the token against a token from our idp (see below in comment).

Lets take some time, read into all the material and build a little prototype.

Expected Result

1. Create simple sample page that is embedded locally in HSP (using the local development capabilities)
2. This sample page gets the luigi token
3. Create an IAS tenant/application for testing
4. Configure the trust in the IAS tenant/application to the HSP idp
5. The sample frontend successfully exchange the HSP token against the IAS token

This should give us an idea how we would implement this and what we have to do to configure it
The following points should be thought of:

• what are do we need to do on the provisioning api
• and what do we need to do for the MCPs

Since this will most likely involve effort from the core team, lets have a clear picture what would be required so we can discuss it with the core team.

Open Questions

Acceptance Criteria

• lay out how we could achieve this, what modifications we need to do in what systems
• basically having a "How to Guide"

Out of scope

• any real implementation

Start by reading the HSP token-exchange material referenced by the issue and review the local-development capabilities for embedding a sample page. Build the requested local sample that retrieves the Luigi token, then document the IAS tenant/application, HSP IdP trust, and exchange result. Finish with a How-to Guide covering required changes for the provisioning API and MCPs.