feat: Pushed Authorization Request (PAR)

[paulswartz]

RFC: https://datatracker.ietf.org/doc/html/rfc9126

Open Questions

• what to do if the PAR request fails, but PAR isn't required? Currently, we always use PAR if it's supported, and fail the URL generation if PAR fails.

[maennchen]

This looks quite good on a first glance. I’ll however read the specification properly before doing a full review.

what to do if the PAR request fails, but PAR isn't required

I think we should error and not try without. If the provider signals support, we should use the most safe option our client supports. I don’t want to introduce any possible downgrade attacks or unnoticed less safe behavior.

If PAR is supported by a provider but broken, the user if this lib should consciously opt out. (#307)

[maennchen]

Preliminary review:

• Add require_pushed_authorization_requests to client registration
• Mention PAR in Supported Features of README

[paulswartz]

@maennchen let me know if the latest commit looks good and I'll rebase it into the previous commit.

[maennchen]

@paulswartz Great job, thanks. A rebase is not necessary since the default is to squash PRs anyways at the moment.