feat(providers): OIDC key binding for the authorization-code and refresh flows - #395

# Which Problems Are Solved

This PR adds client support for [OpenID Key Binding
1.0](https://openid.net/specs/openid-connect-key-binding-1_0.html) a
draft standard for Proof-of-Possession ID Tokens. Basically ID Tokens
that have a public key enabling the user to sign under their identity.

OpenPubkey supports key binding using zitadel/oidc as the library.
However because zitadel/oidc does not natively support key binding,
OpenPubkey has to use [a fragile rounder-tripper work around for the
RP](https://github.com/openpubkey/openpubkey/blob/main/providers/keybinding_provider.go#L109).

This PR allows key binding support for OP and RP:
- Authorization code flow
- Device code flow
- Refresh flow
- Unit tests

This PR is only for client/RP. It does not add key binding to the OP
code. I would like to add that at a future point, but client/RP support
the main blocker to using plain zitadel/oidc with key binding.

I've run manual tests for code flow, refresh and device flow using the
key binding with the Hello OP and this PR in OpenPubkey that runs
against this branch: openpubkey/openpubkey#395

# How the Problems Are Solved

Adds a `WithKeyBinding` option to RP so that the RP can request key
bound ID Tokens from the OP and a `KeyBindingRelyingParty` to perform
the additional steps used by key binding.

```golang
func WithKeyBinding(signer crypto.Signer, alg jose.SignatureAlgorithm) Option
```

# Additional Changes

No additional changes

# Additional Context

Do you want me to port this to v4 as well as v3?

Relevant PRs
- PR adding Key Binding to Authentik
goauthentik/authentik#22590
- [OpenID Key Binding 1.0 Latest
Draft](https://openid.net/specs/openid-connect-key-binding-1_0.html)
- PR to use this RP option in OpenPubkey
openpubkey/openpubkey#395

---------

Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>