UID2-7641: Remove support for V2 refresh tokens

[samin-ttd]

Summary

Fixes a padding-oracle-style information leak in the /token/refresh endpoint. Previously, only ClientInputValidationException during refresh token decoding was caught and mapped to RefreshResponse.Invalid — any other exception (notably BadPaddingException / IllegalBlockSizeException from the underlying cipher on malformed ciphertext) propagated up and resulted in a different response (500) than the standard invalid-token response (400). This discrepancy let an attacker distinguish "malformed padding" from "well-formed but invalid token" purely from the HTTP status code — a classic padding oracle.

Change

• Added a catch-all Exception handler around refresh token decoding.
• BadPaddingException / IllegalBlockSizeException (and any other exception) are now logged and mapped to RefreshResponse.Invalid, so the response is indistinguishable from other invalid-token cases — always 400, no signal leaked to the caller.
• Distinguishes expected padding/block-size failures (WARN) from truly unexpected errors (ERROR) in logging, to preserve operational visibility without changing the response behavior.

Testing

• Send requests crafted to trigger padding against the endpoint both before and after the change: ensure the response is 500 before and 400 after