Consider requiring Spring Security 5.2 for OAuth2 authentication

[scottfrederick]

There are (so far) two changes in Spring Security 5.2 that will benefit Spring CredHub:

1. Spring CredHub has a copy of WebClientReactiveClientCredentialsTokenResponseClient from Spring Security so that the WebClient can be overridden. This ability has been added to Spring Security and will be available in 5.2, at which time Spring CredHub could delete this copied class.

2. Currently a client_credentials grant does not include a refresh token and won't be refreshed automatically by Spring Security when it expires. This has been addressed in Spring Security, and will be available in 5.2.

Blocked on:

• the release of Spring Security 5.2
• determining whether this release is backward-compatible for client apps using Spring Boot 5.1 or if it will require client apps to use Boot 5.2

[scottfrederick]

See https://docs.spring.io/spring-security/site/docs/5.2.0.RELEASE/reference/htmlsingle/#oauth2Client-authorized-manager-provider

[scottfrederick]

Fixed via aa2ae34