PAR endpoint metadata should only be returned when enabled

[jgrandja]

The Pushed Authorization Request (PAR) endpoint should only be returned in the authorization server metadata response and provider configuration response when enabled.