OpenIddict discovery omits 'none' from token_endpoint_auth_methods_supported #379

OpenIddict's default discovery lists client_secret_post/basic and private_key_jwt but not none, so clients like ChatGPT register as confidential; OAuthEndpoints overrides the list and DCR accepts none, client_secret_post and client_secret_basic.

Found while fixing #376 (ChatGPT: 'Dynamic client registration failed: invalid_client_metadata: Only public PKCE clients are supported'). Fix in OAuthEndpoints.cs: the ApplyConfigurationResponse handler sets token_endpoint_auth_methods_supported and revocation_endpoint_auth_methods_supported to [none, client_secret_post, client_secret_basic]; /oauth/register creates a Confidential OpenIddict application with a 256-bit secret (returned once as client_secret, client_secret_expires_at 0) for the secret methods. PKCE S256 stays mandatory for all clients. A token request from a confidential client without a secret returns 401 invalid_client. Test: OAuthTests.ConfidentialClientsRegisterWithSecretAndStillNeedPkce.