V51 OAuth: Add verification for PAR

[TobiasAhnoff]

PAR is part of FAPI 2 requirements and the following verification is suggested to address PAR:

V51.2 Authorization Server

Verify that grant type 'code' is always used together with PAR requiring client authentication (for L1-L2 PAR is optional and could be used without client authentication). (L3)

[elarlang]

@TobiasAhnoff or @randomstuff - please explain, what security problem it solves?

[randomstuff]

The client can make sure that the user does not tamper with the content of the authorization request such as:

• changing the value in a RAR request,
• requiring different scopes than what the authorization server intended.

Moreover this aligns with FAPI 2.0?

[TobiasAhnoff]

Yes, PAR closes a number of tampering issues (integrity protection for the auth request), see e g https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html#name-main-differences-to-fapi-10