feat: make PKCE optional for confidential clients in OAuth server

[gourabsingha1]

Description

This pull request makes PKCE (Proof Key for Code Exchange) optional for confidential clients in the OAuth server, while keeping it mandatory for public clients (such as Single Page Apps or mobile apps) in accordance with OAuth 2.1 guidelines.

Currently, the OAuth server mandates PKCE for all authorization code flow requests regardless of client type. However, confidential clients (which possess secure client secrets and authenticate themselves securely at the token endpoint) do not strictly require PKCE for security.

Changes

• Updated validateRemainingAuthorizeParams and validatePKCEParams in internal/api/oauthserver/authorize.go to accept the client object (*models.OAuthServerClient).
• Modified validatePKCEParams to allow requests from confidential clients (client.IsPublic() == false) where both code_challenge and code_challenge_method are omitted.
• Maintained the requirement that both parameters must be provided if either is present, and kept them mandatory for public clients.
• Added unit tests in internal/api/oauthserver/authorize_test.go to verify:
  • Confidential clients can successfully authorize without PKCE.
  • Public clients still fail to authorize without PKCE.

Fixes #2585