DCR ignores advertised token endpoint authentication methods #1355

Problem

AuthorizationManager::register_client currently always sends
token_endpoint_auth_method: "none". An authorization server can advertise
token_endpoint_auth_methods_supported, including
client_secret_basic or client_secret_post, but dynamic registration does
not currently use that metadata.

This prevents registration against servers that require a confidential client
authentication method. It can also register a confidential method without
checking that the registration response supplied the secret needed to use it.

Proposed direction

• Preserve the current public-client behavior when the metadata field is
  omitted.
• When the field is present, choose the first SDK-supported method in this
  preference order: none, client_secret_basic, then
  client_secret_post.
• Reject a malformed, empty, or unsupported advertised method list before
  sending a registration request.
• If a confidential method is selected, require a non-empty client secret in
  the registration response.
• Continue using the existing OAuth client configuration for Basic and POST
  authentication after registration.

The preference for none preserves a public client when the server supports
one; Basic is preferred over putting a secret in the request body when a
confidential client is required.

Planned validation

Focused recording-client tests would cover omitted metadata, each supported
method, mixed-method preference, malformed/empty/unsupported metadata, and
missing or empty confidential-client secrets. The rejection cases would also
verify whether a registration request was sent.

Would this selection and compatibility policy be acceptable for a focused PR?