oauth2: Requires firewall check for introspecting access tokens

[aeneasr]

From now on, requests introspecting tokens require the client making the request (as identified by the Authorization header) to be allowed to access that endpoint. If an OAuth 2.0 token is given, the scope hydra.introspect is required additonally to a policy granting access to rn:hydra:oauth2:tokens with action introspect.