feat: make client_id and client_secret optional for the token endpoint

[lart2150]

bshaffer/oauth2-server-php supports sending the client id and secret as http basic auth. With client id and secret set as required clients that send them via basic auth instead of in the request body will get an error when they try to exchange the token. This PR allows the client to send the client id and secret either in the request body or basic auth.

[ashfame]

Thanks for highlighting the issue and making the PR!

[ashfame]

For reference: OIDC specifies the following auth methods for client:

• client_secret_basic
• client_secret_post
• client_secret_jwt
• private_key_jwt

We had only used client_secret_post so far, which requires both client_id and client_secret but default auth method for client (if not chosen at registration time) is indeed client_secret_basic. So, it should be supported and for that, this PR is indeed correct to not do validation and let the bshaffer lib handle it.

For auth methods client_secret_jwt and private_key_jwt, two more fields become required: client_assertion and client_assertion_type. For the sake of defining all expected params, I will add them in a follow up PR.