Add tokenExchange grant type to list of allowed grant types for oauth2 shape

[kaheidt]

Current spec definition allows implicit, password, clientCredentials, and authorizationCode for oauth2 flows. This request is to include tokenExchange in the list of grant types/flows.