This PR reduces IAM's dependency on MITRE ID Connect by replacing selected MITRE service interfaces with IAM-owned implementations. The goal is to make the token, client, and protected resource management layers independent from MITRE internals, simplifying future maintenance and evolution while preserving the existing behavior.

This work complements the changes introduced in the related dependency PR:
indigo-iam/OpenID-Connect-Java-Spring-Server#36

Changes:

- Split token handling into IAM-specific Authorization Server and Resource Server services.
- Import the required Protected Resource registration endpoints.
- Import the subset of the Client API currently used by IAM.
- Import the Token API and introduce IAM-owned token DTOs.
- Update the application wiring and affected tests to use the new IAM services.

Additional changes:

- Validate the `iam.issuer` property at startup. The configured issuer URL must end with a trailing `/`.
- Add new audit events:
    - `RegistrationTokenIssuedEvent`
    - `ResourceTokenIssuedEvent`
    - `IdTokenIssuedEvent`

Note:
- This PR is intentionally structured as an intermediate refactoring step to further isolate IAM from MITRE ID Connect internals.