Misc. oauth fixes

Removed the deprecated Resource Owner Password Credentials Grant (RFC 9700 forbids it) and added client_secret validation in the authenticate_client endpoint.