fix: persist the registered OAuth client authentication method

[mvanhorn]

Related Issues

App:

• Add changelog files for the fixed issues in folder changelog/unreleased. More info here
  Not claimed: this diff changes no changelog or release-note file.
• Add feature to Release Notes in ReleaseNotesViewModel.kt creating a new ReleaseNote() with String resources (if required)
  Not claimed: ReleaseNotesViewModel.kt was not run locally either.

---

QA

Before dynamic registration, the app selects one method from discovery: client_secret_basic when that method is advertised or when the list is omitted, and client_secret_post only when basic is absent. A list that contains neither method stops registration with an error and does not send a request. The selected method is carried on the registration result, saved on the account as token_endpoint_auth_method, and reused for the authorization-code exchange and for refresh. A previously registered client with no stored method stays on Basic, which is how it was registered. Clients that were never dynamically registered still use client_secret_post when discovery advertises it.

Adding an account fails on an identity provider that locks a dynamically registered OAuth client to the authentication method used at registration, such as current Keycloak. The app registers the client with one token-endpoint method and then calls the token endpoint with the other, so client authentication is rejected and login never completes. Registration always submitted client_secret_basic, while the authorization-code exchange and token refresh switched to client_secret_post whenever OpenID discovery advertised it. The method chosen at registration was not stored with the client, so a server that offers both methods saw a different method on later requests. Accounts created earlier have no recorded method to reuse.

Fixes #4891

AI was used for assistance.

[joragua]

Thanks for this contribution @mvanhorn! 🍻 Some notes before doing the CR:

1. Could you split the changes into separate commits to keep the history clear? The calens file should be added in its own commit (chore: add calens file), the implementation in another commit (fix: ...) and the tests in a different one (test: ...)

2. We only maintain (at this moment) tests for repositories and data sources, so you can remove any tests that don't belong to these classes. Also, please make sure the remaining tests follow the same conventions, including test naming and structure (setup, assert, verify, etc)

3. This is not an easy fix, so it will take us some time to review the PR and verify that the implementation is correct. Thanks for your patience, and stay tuned!

Ping us if you have any doubts about the points that I commented and we will be happy to help you! 🙌🏻

[mvanhorn]

Thanks @joragua. Split into three commits (chore: add calens file, fix: persist the registered OAuth client authentication method, test: cover the persisted OAuth client authentication method) and force pushed. I dropped the viewmodel and domain tests, so only OCLocalAuthenticationDataSourceTest and OCRemoteOAuthDataSourceTest remain, and the remote error case now uses @Test(expected = ...) like the other datasource tests. OCRemoteOAuthDataSourceTest passes locally; the androidTest file compiles, but I couldn't run it without a device.