Add httpsig to RS token introspection requests

[wilsonianb]

https://datatracker.ietf.org/doc/html/draft-ietf-gnap-core-protocol#section-7.3

https://github.com/interledger/rafiki/blob/main/packages/backend/src/open_payments/auth/service.ts#L47

• might require: Validate /introspect with RS key instead of client key #556
• required for: Finish Local development demo #574
• related to: feat(auth): httpsig request validation #387

[wilsonianb]

Since we're assuming the RS and AS are operated by the same account provider, we can make token introspection http signature validation optional. The AS won't publicly expose that endpoint.

[matdehaast]

Closing for now due to AS-RS being in a trusted zone