feat(oidc,client): Adds support for OpenID Key Binding to client

[EthanHeilman]

Which Problems Are Solved

This PR adds client support for OpenID Key Binding 1.0 a draft standard for Proof-of-Possession ID Tokens. Basically ID Tokens that have a public key enabling the user to sign under their identity.

OpenPubkey supports key binding using zitadel/oidc as the library. However because zitadel/oidc does not natively support key binding, OpenPubkey has to use a fragile rounder-tripper work around for the RP.

This PR allows key binding support for OP and RP:

• Authorization code flow
• Device code flow
• Refresh flow
• Unit tests

This PR is only for client/RP. It does not add key binding to the OP code. I would like to add that at a future point, but client/RP support the main blocker to using plain zitadel/oidc with key binding.

I've run manual tests for code flow, refresh and device flow using the key binding with the Hello OP and this PR in OpenPubkey that runs against this branch: openpubkey/openpubkey#395

How the Problems Are Solved

Adds a WithKeyBinding option to RP so that the RP can request key bound ID Tokens from the OP and a KeyBindingRelyingParty to perform the additional steps used by key binding.

func WithKeyBinding(signer crypto.Signer, alg jose.SignatureAlgorithm) Option

Additional Changes

No additional changes

Additional Context

Do you want me to port this to v4 as well as v3?

Relevant PRs

• PR adding Key Binding to Authentik providers/oauth2: OpenID key binding support goauthentik/authentik#22590
• OpenID Key Binding 1.0 Latest Draft
• PR to use this RP option in OpenPubkey feat(providers): OIDC key binding for the authorization-code and refresh flows openpubkey/openpubkey#395

[EthanHeilman]

@wim07101993 How much interest is there in merging this? Do you want me to move this to v4 rather v3?