Support OIDC Device Authorization Grant for API

Please add support for OIDC Device Authorization Grant. This is useful for running scripts that access the NiFi API from the CLI. At this time the options are:

1. Copy __Secure-Authorization-Bearer cookie from the browser session: not really a good practice, work and error prone
2. Enable MTLS: painful for the users as the browser starts to frequently challenge for the client cert and even if it worked fine, client certificate management process is typically lagging behind OIDC identity management
3. Use passwords: insecure and prohibited by policy

Having an API endpoint in the Access group that would allow the caller to exchange OIDC id or refresh token for a NiFi session token would be perfect for this use case.