feat: add Bedrock identity verifier API

api/src/main/java/com/minekube/connect/api/player/bedrock/BedrockIdentityClaims.java

@@ -0,0 +1,24 @@
+package com.minekube.connect.api.player.bedrock;
+
+import java.time.Instant;
+import lombok.Value;
+
+@Value
+public class BedrockIdentityClaims {
+    String issuer;
+    String endpointId;
+    String endpointName;
+    String orgId;
+    String sessionId;
+    String protocol;
+    String bedrockAuthPolicy;
+    String principalType;
+    String bedrockXuid;
+    String bedrockUsername;
+    String bedrockDerivedUuid;
+    String linkedJavaUuid;
+    String linkedJavaName;
+    Instant issuedAt;
+    Instant expiresAt;
+    String nonce;
+}

api/src/main/java/com/minekube/connect/api/player/bedrock/BedrockIdentityReplayCache.java

@@ -0,0 +1,25 @@
+package com.minekube.connect.api.player.bedrock;
+
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.Map;
+
+public final class BedrockIdentityReplayCache {
+    private final Map<String, Long> seen = new HashMap<>();
+
+    synchronized boolean accept(String endpointId, String sessionId, String nonce, long nowUnixMs, long expiresAtUnixMs) {
+        Iterator<Map.Entry<String, Long>> iterator = seen.entrySet().iterator();
+        while (iterator.hasNext()) {
+            if (iterator.next().getValue() <= nowUnixMs) {
+                iterator.remove();
+            }
+        }
+
+        String key = endpointId + "\0" + sessionId + "\0" + nonce;
+        if (seen.containsKey(key)) {
+            return false;
+        }
+        seen.put(key, expiresAtUnixMs);
+        return true;
+    }
+}

api/src/main/java/com/minekube/connect/api/player/bedrock/BedrockIdentityVerificationException.java

@@ -0,0 +1,11 @@
+package com.minekube.connect.api.player.bedrock;
+
+public class BedrockIdentityVerificationException extends Exception {
+    public BedrockIdentityVerificationException(String message) {
+        super(message);
+    }
+
+    public BedrockIdentityVerificationException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}