Add ability to disable an endpoint

[SledgeHammer01]

Spin off of #1454

Expected Behavior
As discussed in #1454, there is no clean way to disable the endpoints (including removing the filters, etc) we don't want. In our case, we want ONLY /oauth2/token and disable everything else including ./well-known, etc.

Current Behavior
Out of the box experience is that many endpoints are enabled for all the different flows, i.e. /authorization /.well-known, token revoke, introspect, etc.

Context
From a security perspective, our company has regular pen testing and SecOps and we get complaints about disabling unnecessary endpoints to minimize attack vectors.

If the user is configured for client credentials post for example, they can still send requests to all the other oauth endpoints and they are returning 400s if the request is malformed, letting an attacker know they are there. Also this is adding unnecessary processing since the filters are there and do checks to validate the requests.

[jgrandja]

@SledgeHammer01 This enhancement makes sense. We'll consider adding it.

[AlTurner-MOJ]

We are in an identical situation and following a PEN test have been asked by our AppSec team to disable unused end points. We are only using the /oauth2/token and /oauth2/authorize end points.

[tommyttf]

Hi @jgrandja, I am interested in working on this issue, and have read your comment in #1498 that we better not to have a flag setting for each configurer. How about we have aremoveConfigurer function and disableXXXEndpoint for each configurer

For example in OAuth2AuthorizationServerConfigurer

	public OAuth2AuthorizationServerConfigurer disableDeviceVerificationEndpoint() {
		removeConfigurer(OAuth2DeviceVerificationEndpointConfigurer.class);
		return this;
	}

...

	@SuppressWarnings("unchecked")
	private void removeConfigurer(Class<?> type) {
		this.configurers.remove(type);
	}

Then we can disable the endpoint by

		http
			.with(authorizationServerConfigurer, (authorizationServer) ->
				authorizationServer
						.disableDeviceVerificationEndpoint()
			)

What do you think?

[OrangeDog]

This should follow the same pattern as AbstractHttpConfigurer, and add disable() to AbstractOAuth2Configurer.

I do not like @tommyttf's solution at all, as it's inconsistent with anything else.