Move the extension from specification/draft/ to specification/stable/ to
indicate it is ready for use and has reference implementations. Update the
README to list stable and draft extensions separately, and update the
in-document status banner to match.
Reduce duplication by referencing draft-ietf-oauth-identity-assertion-authz-grant-04
for roles, token exchange parameters, ID-JAG claims, and processing rules,
keeping only MCP-specific constraints inline.
- Adopt 'Resource Authorization Server' terminology from id-jag §2
- Replace parameter/claim tables with section references plus MCP deltas
- Keep `resource` REQUIRED in this profile (id-jag-04 made it optional)
- Drop the restriction on `actor_token` (removed upstream in -03)
- Replace multi-tenant implementation notes with reference to id-jag §6
- Reference id-jag §5 for cross-domain client_id handling
- Add Discovery section referencing `authorization_grant_profiles_supported`
The specification for "OAuth 2.0 Token Exchange" is RFC 8693.
https://datatracker.ietf.org/doc/html/rfc8623 refers to a different specification,
so the current link is correct. This PR fixes the incorrect link label.
