feat(jans-auth-server): upgrade to oauth 2.1

### Description

https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/

The plain PKCE method is removed; authorization servers must return iss; PAR is explicitly recognized; consent-phishing guidance is added; and authorization-endpoint error behavior is clarified.

Why it matters: Janssen should confirm that OAuth 2.1 mode rejects plain, always emits iss, and matches the revised error rules. Most changes should already align with FAPI-oriented behavior.

[OAuth Attestation-Based Client Authentication -11](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/) — September 3
Challenge support is optional, but servers using it must return a fresh challenge. Combined attestation/DPoP mode now exclusively uses the DPoP nonce mechanism. New client metadata parameters describe supported behavior.

Why it matters: This affects Janssen’s future native-app and wallet attestation architecture. Reusing the existing DPoP nonce machinery could avoid creating a parallel challenge subsystem.

### Test cases and code coverage

- [ ] Write unit test to cover added/changed code
- [ ] Update integration tests to cover added/changed code
- [ ] Documentation