feat: let ResourceProtector take a token_validator in __init__ - #925

Closes #603. That issue's been open a while with no response, so wanted to flag up front: I haven't gotten explicit sign-off on this direction from a maintainer — happy to adjust or drop this if the API isn't wanted as-is.

What this does

ResourceProtector() always needed a follow-up .register_token_validator(...) call before it was usable, even for the common single-validator case. This adds an optional token_validator kwarg to __init__ that just calls register_token_validator() internally:

# before
require_oauth = ResourceProtector()
require_oauth.register_token_validator(MyBearerTokenValidator())

# now, equivalently
require_oauth = ResourceProtector(token_validator=MyBearerTokenValidator())

register_token_validator() itself is untouched — it's still how you add more than one validator (e.g. supporting a second token type alongside bearer).

Scope

Flask's and Django's ResourceProtector subclasses don't override __init__, so they inherit this for free — no changes needed in either integration module. I checked OAuth1's ResourceProtector too: it's a completely separate class (query_client/query_token/exists_nonce callbacks, no register_token_validator concept at all), so this doesn't apply there and I left it alone.

Changes

• authlib/oauth2/rfc6749/resource_protector.py — the __init__ change
• tests/core/test_oauth2/test_resource_protector.py — new file (there wasn't a dedicated unit test for ResourceProtector itself, only Flask/Django integration-level coverage). Covers: no-validator behavior is unchanged, the constructor path and register_token_validator() end up in the same state, and additional validators can still be registered afterward.
• docs/oauth2/resource-server/flask.rst, docs/oauth2/resource-server/django.rst — updated the getting-started examples to the new form
• docs/upgrades/changelog.rst — entry under Unreleased

Testing

pytest tests/core/ tests/flask/ tests/django/

599 passed, 2 skipped (pre-existing, unrelated) — ran against the full suite, not just the new test file, to make sure nothing else assumes ResourceProtector.__init__ takes no arguments. ruff check and ruff format --check both clean.