[Client] Support JWT for Client Authentication, as defined in RFC 7523

[marvin-kolja]

Expected Behavior

I would like to be able to use an externally signed JWT for Client Authentication (as defined in RFC 7523).

The developer should be able to configure the JWT as a String or path to a file.

Current Behavior

The current OAuth2 Client has full support for the OIDC Client Authentication specification (https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication). In this context, this namely includes private_key_jwt and client_secret_jwt. However, these are built on top of RFC 7523 and this does not support providing a custom JWT for client_assertion.

Context

• Keycloak has a feature called "Federated Client Authentication" that allows a client to use JWTs (e.g. Kubernetes ServiceAccount Tokens) as a credential (https://www.keycloak.org/2026/01/federated-client-authentication).
  • This does not follow OIDC specification, but merely supports what is defined in RFC 7521, or more precisely RFC 7523.

Related to #8175