Fix(oauth2)!: require PKCE for public clients

Public OAuth clients without a secret are vulnerable to authorization code interception; PKCE is now required per updated RFC guidance to protect the authorization code exchange.