SEP-1046: support for OAuth client credentials flow extension

[findleyr]

Investigate if we can/should add support for SEP-1046, an authorization extension.

[jba]

This extension fits into our general framework, #591.

Our default implementation for that framework should support client ID and client secret as options, to handle that variant. Those were mentioned in my original design,#255. If those are set, our implementation would bypass dynamic client reservation. That is just a couple of lines of code, I believe.

We could also provide an implementation of JWT Assertions. I read that RFC a couple of times and it's still not clear to me what the API for that would look like. Perhaps we can take our lead from other SDKs, such as TypeScript.