Add success and failure handlers to OAuth2AuthorizationCodeGrantFilter

[dlwhdgus0810]

Closes gh-19051

OAuth2AuthorizationCodeGrantFilter always redirects after processing the Authorization Response: to the saved request or the redirect_uri on success, and to the redirect_uri with error parameters on failure. There was no way to render an error page, redirect somewhere else, or add auditing around the exchange without replacing the filter.

This adds:

• OAuth2AuthorizationCodeGrantFilter#setAuthenticationSuccessHandler and #setAuthenticationFailureHandler
• successHandler(...) and failureHandler(...) on oauth2Client().authorizationCodeGrant()
• authenticationSuccessHandler / authenticationFailureHandler in the Kotlin AuthorizationCodeGrantDsl

When no handler is configured the filter behaves exactly as before, so this is not a breaking change. I kept the existing redirect code as the default path rather than wrapping it in default handler instances, because the default success redirect needs the redirect_uri of the Authorization Request removed from the repository, which an AuthenticationSuccessHandler does not receive.

The success handler is called after the authorized client is saved and receives the OAuth2AuthorizationCodeAuthenticationToken. The failure handler receives an OAuth2AuthenticationException carrying the OAuth2Error, with getAuthenticationRequest() returning the token that failed, so a custom handler still has access to the authorization request. As before, only OAuth2AuthorizationException is handled; other exceptions propagate unchanged.

Tests: new unit tests in OAuth2AuthorizationCodeGrantFilterTests (null checks, custom success and failure handlers), plus configuration tests in OAuth2ClientConfigurerTests and AuthorizationCodeGrantDslTests. Existing tests are unchanged. The reference docs and What's New are updated as well.

The reactive OAuth2AuthorizationCodeGrantWebFilter and the XML namespace are not changed here; happy to follow up if you'd like them aligned.