feat: add note to TokenRevokeRequest and TokenRevokeResponse about 20-token-per-call limit

[fabiohidekihirose]

Clickup ticket: https://app.clickup.com/t/9002222883/ENG-5662

Problem

There is an undocumented limitation on the /api/auth/token/revoke API call that silently restricts bulk revocation to 20 tokens per request (controlled by the token.revoke.count.max parameter). Customers wrongly believe that all tokens will be revoked with just one call; however, this is not the case, and they need to make multiple calls until the count drops to zero. This was discovered by a customer (Unisys-Resonatex) through an unpleasant experience during a security event that required the revocation of 350,000 tokens.
We also never told customers the safe way to do bulk revocation. Just looping the API without preparation can go wrong in multiple ways.

Java SDK (authlete-java-common)

• Add a note to TokenRevokeRequest class explaining the 20-per-call cap and that you need to loop
• Add a note to TokenRevokeResponse#count field saying loop until this hits zero

Content source: https://git.authlete.com/support-tools/agent-knowledge/-/merge_requests/39/diffs#a4afaf7dfe99f2e5f00d1d1aa5ff099f07325867

[rehanalam]

This note should also be added to the public getter/setter Javadocs, not only the private field.

[rehanalam]

@fabiohidekihirose

[rehanalam]

@fabiohidekihirose This Javadoc uses Markdown syntax like backticks and bold, but Javadoc won’t render that correctly. Can we use Javadoc tags instead, e.g. {@code clientIdentifier} and tag instead of 20 tokens per request, to keep it consistent with the rest of the file?