TokenBindingSupport
Shared machinery behind {@see TokenValidation::status()}/`verifyPossession()` and {@see TokenIntrospection::status()}/`verifyPossession()` (CONTRACT.md §10.1 rule 9, §10.3, contract 1.51).
Both wire messages carry an optional CnfClaim, and CONTRACT.md §10.3 rule 1 requires
that a gRPC-validating SDK apply EXACTLY the rule §10.1 already applies to a locally
verified token — never a second, looser implementation. Routing both through
JwksVerifier::verifyTokenBinding() (the same primitive
AxiamClient::verifyWithProofs() uses) is what makes that true by construction: local
verification and gRPC validation share one rule-9 implementation, so the two cannot
disagree about whether a token is a bearer token (§10.1 rule 9 detail 4).