Do not validate parameters in ServerBearerTokenAuthenticationConverter and DefaultBearerTokenResolver if not enabled

[jonah1und1]

Closes issue: #16038

[sjohnr]

Thanks for the PR @jonah1und1! I have provided some feedback on tests below.

[jonah1und1]

Thanks for the feedback!
I incorporated your suggestions and added some code to fix failing tests in OAuth2ResourceServerConfigurerTests.java and OAuth2ResourceServerBeanDefinitionParserTests.java, please feel free to comment.

[sjohnr]

Thanks for providing updates @jonah1und1! I wanted to let you know an update from my side as well: I spoke with a team member on our approach here to validate parameters up front. I realize I should have done this prior to responding to the original PR, as the feedback I received pointed out an alternative to this approach.

The alternative approach is to actually have multiple implementations of BearerTokenResolver instead of one implementation with multiple boolean flags. This would allow a delegating implementation that composes whichever options the user wants to enable. However, there would still be two strategies for composing multiple resolvers together that result in different outcomes:

1. Try multiple delegates and find the first non-null returning one.
2. Try all delegates and throw an error if more than one returns something. (similar to this PR)

Having the option to do one or the other of these is clearly more flexible, at the expense of requiring user-defined delegation logic. So we would need to provide one of the delegating patterns above as well, and would need to choose which one to provide. In any case, if we took this approach, we would have to go back to the drawing board on this PR.

Long story short, I think I'd like to pause on this for a bit and think about it more before deciding how to move forward. We don't want to make a change only to realize it was the wrong change, so I think it best to hold off and not merge anything into the upcoming release. I apologize for any inconvenience, and thank you for contributing what you have so far. Let me know if anything I said doesn't make sense.