Allow disabling OAuth2 / OIDC provider discovery explicitly

I think it would be useful to disable the OAuth2 / OIDC discovery explicitly. At this moment this is possible implicitly by configuring every necessary detail of the client's registration and provider but skipping the provider's issuerUri. This disables the discovery via OAuth2ClientPropertiesMapper.

Why

• Someone wants the service to not require the IdP to be available at startup.

• Some code may need the issuerUri to function properly.

  In fact, there already is such code: Spring Securitys OIDC back channel logout validates the providers issuerUri in OidcBackChannelLogoutTokenValidator and ends up with a NPE if you did not set an issuerUri.

  So setting the issuerUri means you are forced to use discovery.
  Leaving it null means no working back channel logout, at least not with auto configuration.

How?

I'm not quite sure. Maybe a new property:

# default (fallback) value: true
spring.security.oauth2.client.provider.MY_PROVIDER.discovery=false

Setting this to false would opt-out the discovery. The current behaviour should be kept as default.

Start with OAuth2ClientPropertiesMapper.java, especially the provider registration mapping around the issuerUri handling, then review the referenced OidcBackChannelLogoutTokenValidator.java behavior. Determine how an explicit opt-out could coexist with the current default discovery behavior; done means discovery can be disabled without requiring the identity provider at startup.