feat: implement legacy OS-OAUTH2 extension (/v3/OS-OAUTH2/*)

[gtema]

Parent issue: #938

Implement the legacy OS-OAUTH2 extension API (/v3/OS-OAUTH2/*) for compatibility with Python Keystone.

Important Context

This is a secondary OAuth2 implementation, distinct from the native OAuth2/OIDC provider defined in ADR 0026 (#939). It is:

• Python Keystone compatible: A drop-in replacement for the legacy OS-OAUTH2 extension that Python Keystone exposes at /v3/OS-OAUTH2/*
• Based on application credentials: The implementation leans on the existing application credentials mechanism as its internal token representation, mirroring how Python Keystone's legacy OAuth2 bridge works
• Not a standalone OAuth2 server: The ADR 0026 OAuth2/OIDC provider is the primary, full-featured OAuth2 implementation. This legacy extension exists solely to maintain API compatibility with clients written against Python Keystone's OS-OAUTH2 namespace

Endpoints to implement

Endpoint	Actions
/v3/OS-OAUTH2/access_tokens	POST (create), GET (list)
/v3/OS-OAUTH2/access_tokens/{access_token_id}	GET (show), DELETE
/v3/OS-OAUTH2/refresh_tokens/{refresh_token_id}	GET (show), DELETE
/v3/OS-OAUTH2/authorization_requests	POST (create), GET (list)
/v3/OS-OAUTH2/authorization_requests/{request_id}	GET (show), PATCH (update), DELETE

Reference

• Python Keystone legacy OAuth2: keystone/oslo.oauth2 / keystone.contrib.oslo.oauth2
• Tempest tests: tempest.api.identity.v3.test_os_oauth2.*
• Related: Implement ADR 0026 - making keystone oauth2 OP #939 (ADR 0026 native OAuth2/OIDC provider — separate, primary implementation)

Notes

• Follow existing CRUD patterns (backend.rs convention)
• Policy enforcement via OPA Rego in policy/
• Unit tests: valid auth + positive/negative policy, invalid auth (per AGENTS.md)