Generic handling of client authentication

[TimoGlastra]

• use client authentication callback / generic interface (with method key to distinguish) for par, authorization challenge, and token endpoint instead of client attestation specific logic
  • This is partially done feat: oid4vci draft 15 support #56. An improvement could be to allow passing the client authentication as param rather than global callback as well
• replace the client attestation logic in the oauth2 server side with a verify client authentication method beforehand which is separate from the authorization request endpoint