Report `none` and `client_secret_post` in `token_endpoint_auth_methods_supported`

https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata

> token_endpoint_auth_methods_supported
OPTIONAL. JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html#OpenID.Core) [OpenID.Core]. Other authentication methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of [OAuth 2.0](https://openid.net/specs/openid-connect-discovery-1_0.html#RFC6749) [RFC6749].

https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

> client_secret_post
Clients that have received a client_secret value from the Authorization Server, authenticate with the Authorization Server in accordance with Section 2.3.1 of [OAuth 2.0](https://openid.net/specs/openid-connect-core-1_0.html#RFC6749) [RFC6749] by including the Client Credentials in the request body.

> none
The Client does not authenticate itself at the Token Endpoint, either because it uses only the Implicit Flow (and so does not use the Token Endpoint) or because it is a Public Client with no Client Secret or other authentication mechanism.

Start with the OpenID Connect Discovery specification linked in the issue and locate where token_endpoint_auth_methods_supported is produced. Check how the discovery metadata is assembled, then verify that the advertised methods include none and client_secret_post and that the relevant discovery output remains valid.

Written by the indexing model from the issue text.