Support token introspection

## Is your feature request related to a problem? Please describe.

Currently, `PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD` accepts two values:

- `jwt`: As an OAuth2 resource server, oCIS is able to cryptographically verify JWTs.
- `none`: Skip it. The OIDC userinfo endpoint is used as a last resort, because it needs the token to be active.

However,

- local validation does not replace introspection in certain cases, such as when we need a server-side logout to immediately invalidate all access.
- It is also not good practice to use the userinfo endpoint as introspection.

## Describe the solution you'd like
Support OAuth2 token introspection .

## Describe alternatives you've considered
There is no alternative to introspection if immediate logout is needed.

## Additional context
I might submit a pull request in a few days.