feat(oidc,client,op): Adds support for OpenID Key Binding

[EthanHeilman]

Which Problems Are Solved

This PR adds support for OpenID Key Binding 1.0, a draft standard for Proof-of-Possession ID Tokens. Basically ID Tokens that have a public key enabling the user to sign under their identity.

OpenPubkey supports key binding using zitadel/oidc as the library. However because zitadel/oidc does not natively support key binding, OpenPubkey has to use a fragile rounder-tripper work around for the RP.

This PR allows key binding support for OP and RP:

• Authorization code flow
• Device code flow
• Refresh flow
• Unit and end-to-end tests
• Documentation

Two things not done:

• This PR does not add Token Exchange. This is something we would like to add, but in a separate PR.
• This PR does not prevent replayed jti claims, this is an optional and zitadel/oidc did not have the existing caching infrastructure to support it.

Remaining tasks are:

This PR is a work-in-progress

• Building without errors, tests passing
• Create PR to OpenPubkey that runs against this PR to verify everything is working correctly.
• Additional code clean up and review
• Manual tests

How the Problems Are Solved

Additional Changes

No additional changes

Additional Context

• PR adding Key Binding to Authentik providers/oauth2: OpenID key binding support goauthentik/authentik#22590
• OpenID Key Binding 1.0 Latest Draft

Would this fit better in v3 or v4?