Feat: on behalf of token exchange support

[tanya732]

Summary

Adds On-Behalf-Of (OBO) Token Exchange validation support to the Java resource-server SDK

As a resource-server SDK, this library validates tokens and does not act as an OAuth client, so it does not implement the token-exchange call (getTokenOnBehalfOf)

This PR exposes read-only accessors for the RFC 8693 act claim and the org_id claim on validated tokens.

What's added

Three accessors, on both the core AuthenticationContext and the Spring Auth0AuthenticationToken:

• getActor() - the current actor (act.sub), i.e. the client that performed the exchange. Per RFC 8693 §4.1, this is the only actor to use for access-control decisions. Returns null for a direct (non-exchanged) token.
• getPriorActors() - the delegation chain (nested actors), ordered most-recent → original. Informational only (audit/logging); MUST NOT be used for access control per RFC 8693 §4.1. Returns an empty list when there are none.
• getOrganizationId() - the org_id claim. Organization membership and RBAC are enforced by Auth0 at token issuance; the resource server simply reads the preserved value.

Changes

Area	File
Core accessors	auth0-api-java/.../models/AuthenticationContext.java
Spring delegators	auth0-springboot-api/.../Auth0AuthenticationToken.java
Core tests	auth0-api-java/.../models/AuthenticationContextTest.java
Spring tests	auth0-springboot-api/.../Auth0AuthenticationTokenTest.java
Docs	auth0-springboot-api/EXAMPLES.md, README.md

Test plan

• Core AuthenticationContextTest: single actor, chained actors, org_id present/absent, act not-a-map, missing sub, unmodifiable prior-actors list
• Spring Auth0AuthenticationTokenTest: delegation of all three accessors
• Full suite passes for both modules; no changes to existing behavior