Opaque Token Introspector should return an Authenticated Principal

[jzheaux]

Similar to OAuth2UserService, which returns an OAuth2User (which is an AuthenticatedPrincipal), it'd be appropriate for OpaqueTokenIntrospector to return OAuth2AuthenticatedPrincipal.

It shouldn't return an OpaqueToken because the token is no longer opaque once it returns from introspection.