feat: Add a flag to enforce PKCE only for public clients

[pjcdawkins]

Related issue

Alternative proposal for the issue discussed in #389 and #391, where enforcement of PKCE is wanted only for certain clients.

Proposed changes

Add a new flag EnforcePKCEForPublicClients which enforces PKCE only for public clients. The error hint is slightly different, as it mentions PKCE is enforced for "this client" rather than "clients". (It intentionally does not mention why it's enforced, as I think basing it on public clients is an implementation detail that servers may want to change without adding to the error hints)

I didn't use an enum, as suggested in #391, because I imagine it would be a backwards compatibility problem. I could be convinced otherwise.

Checklist

• I have read the contributing guidelines
• I have read the security policy
• I confirm that this pull request does not address a security vulnerability
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation within the code base (if appropriate)

[aeneasr]

Thank you! I'll release this right after merge if you need this in Hydra :)