feat: CTE delegation and impersonation support

[yogeshchoudhary147]

Summary

Adds delegation and impersonation support for Custom Token Exchange (CTE) per RFC 8693, allowing an actor (e.g. an AI agent or support rep) to act on behalf of a user.

• Add customTokenExchange() for stateless token exchange (no session side effects)
• Add actor_token and actor_token_type to CustomTokenExchangeOptions
• Add ActClaim type and act claim to IdToken and User
• Add skipTokenStorage flag so refresh_token is discarded inside the worker and never reaches the main thread (non-worker path returns the raw response as documented)
• customTokenExchange() validates id_token when present, consistent with loginWithCustomTokenExchange

Test plan

• All existing tests pass (938 passing)
• customTokenExchange(): no session side effects, correct params, actor token, audience/org fallback
• customTokenExchange(): id_token verified when present, skipped when absent
• Worker skipTokenStorage: response stripping, no storage side-effect, no overwrite of existing tokens
• loginWithCustomTokenExchange() with actor token, isAuthenticated() returns true
• getIdTokenClaims().act and getUser().act populated correctly
• No error when refresh_token is absent (suppressed by Auth0 when actor_token is present)
• Auth0 error codes surfaced via standard SDK error types

Intentional omissions

• Paired parameter validation: Auth0 returns a clear error (invalid_request). No benefit duplicating this client-side.
• URI validation: Auth0 validates server-side and returns a clear error. Duplicating adds complexity with no real benefit.

[kishore7snehil]

When no Web Worker is configured, customTokenExchange() calls oauthToken() with skipTokenStorage: true, but the non-worker path (fetchWithoutWorker) does not use skipTokenStorage - it returns the raw JSON response including any refresh_token. The worker path always strips it, so this is inconsistent. The caller receives the refresh_token in the non-worker path which could lead to accidental token leakage.

Can we strip refresh_token from the response in customTokenExchange() before returning, regardless of whether a worker is used. Something like this :

const { refresh_token, ...safeResult } = await oauthToken(...);
return safeResult;

[yogeshchoudhary147]

The worker strips refresh_token because of its own internal security model (unconditional for all calls), not as a contract of customTokenExchange. Stripping on the non-worker path would be silent data loss against an explicit TokenEndpointResponse return type; behavior is intentional and documented.

[kishore7snehil]

LGTM!