KTOR-9785 Typesafe Authentication DSL

* Add typed auth DSL to server auth

* Add typed auth builders for API key and JWT

* remove roles caching; move modules

* make sessions typesafe

* Update typed session auth ABI

* Update typed auth callbacks to RoutingContext

* remove unneeded bearer overload

* pass application call to AuthenticatedContext methods

* Add session refresh hooks to typed session auth config.

Port TypedSessionAuthConfig changes from OIDC session refresh work.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix nesting; move typed principal to call

* leave experimental api only on scheme factories

* Add typed OAuth with session support (#5567)

* Add typed OAuth with session support

# Conflicts:
#	ktor-server/ktor-server-plugins/ktor-server-auth/api/ktor-server-auth.api
#	ktor-server/ktor-server-plugins/ktor-server-auth/api/ktor-server-auth.klib.api

* remove unused method

* Add typed OAuth2 session flow

* rethink oauth flow api

* support post oauth callback

* Verify state before invoking the dynamic token-parameter hook

* redesign authentication scheme optionality; add more use-case tests

* Move typed auth dsl from typesafe package

* Use where clause in generics

* Introduce InternalKtorSubclassing annotation

* Fix and add KDoc, introduce PrincipalOptionality and InternalKtorSubclassing

* Fix ABI

* revert updates to OAuthServerSettings; not relevant for the PR

* update abi

* Add mapPrincipal and rename AuthenticatedContext to PrincipalContext

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix abi

* fix native tests

* fixup

* Rotate session ID on OAuth session callback to prevent session fixation

Store the authenticated session under a freshly generated session ID and
invalidate any ID that arrived with the callback request. For deferred
sessions, force the lazy load first so the incoming ID is tracked before
it is discarded.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Use a single client authentication method in OAuth2 token requests

Per RFC 6749 2.3, when accessTokenRequiresBasicAuth is enabled the client
secret is sent only in the Authorization header, no longer duplicated in
the form body. The test OAuth2 server now accepts Basic credentials like
a real token endpoint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Default typed session transport to server-side session IDs

The typed session DSL defaulted to a by-value cookie with no
transformers, so the serialized session value - the authenticated
identity - was sent to the client unprotected and could be forged.
Default to SessionTransportType.CookieId backed by an in-memory
storage private to the scheme, so the client only holds a random
session ID. By-value transports remain available; their KDoc now
recommends a tamper-protecting transformer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Reject failed typed authentication when onUnauthorized does not respond

A route- or scheme-level onUnauthorized that completed without
responding left the call unhandled, so the route handler ran without
a principal and protected actions could execute anonymously. After a
custom handler that does not respond, fall back to provider
challenges and reject the call with 401 Unauthorized when nothing
responded. Same for authenticateWithAnyOf.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>