Check OIDC token type and return 401 for invalid bearer tokens

[sberyozkin]

Fixes #10717

This PR:

• adds an optional token type check, and if the property is not set, does check as the last try, that Keycloak issued valid refresh tokens can not be used to get an access. if a RT is sent and is valid, it can be verified successfully.
  In fact, even without this PR, the test would get 403 because RT would have no expected roles (403 in this case is not issued by quarkus-oidc but by the follow up roles checker), but the correct response is not even get the RBAC layer exercised and return 401 immediately since the token is invalid.
• so I had to fix BearerAuthenticationMechanism, the challenge should really be 401 all the time, 403 implies that the actual token is valid (signature, different verification constraints), only roles are not matching but RBAC is not even enforced yet by the time Challenge is made so it should be 401