[feat]: Add Pushed Authorization Request support

### Prerequisites

- [x] I have written a descriptive issue title
- [x] I have searched existing issues to ensure the feature has not already been requested

### 🚀 Feature Proposal

Add support for **OAuth 2.0 Pushed Authorization Requests (PAR)** as defined in [RFC 9126](https://datatracker.ietf.org/doc/html/rfc9126).

PAR enhances OAuth 2.0 security by allowing clients to push authorization request parameters directly to the authorization server via a backchannel POST request to a dedicated PAR endpoint, rather than passing them through the browser as URL parameters. The authorization server responds with a `request_uri` that references the pushed data, which is then used in the subsequent authorization request.

This feature would enable `@fastify/oauth2` to support modern OAuth 2.0 security best practices, particularly for applications handling sensitive data or operating in regulated industries.

### Motivation

**Security Benefits:**
- **Prevents parameter tampering**: Moving sensitive parameters from front-channel (browser) to backchannel (server-to-server) communication eliminates risks of URL parameter manipulation and exposure in browser logs
- **Early client authentication**: PAR allows authorization servers to authenticate clients before user interaction begins, preventing unauthorized or spoofed requests early in the OAuth flow
- **Reduced attack surface**: Eliminates exposure of sensitive parameters like `scope`, `redirect_uri`, and client secrets in user-agent URLs

**Technical Benefits:**
- **Shorter URLs**: Complex authorization requests with lengthy parameters are reduced to a compact `request_uri`, avoiding browser URL length limitations
- **Early validation**: Parameters are validated at the PAR endpoint before user redirection, reducing errors and improving user experience

**Compliance Benefits:**
- **Privacy alignment**: Minimizes data leakage risks by avoiding front-channel transmission of sensitive parameters, aiding compliance with GDPR and other privacy regulations
- **Auditability**: Centralized handling of authorization requests simplifies audit trails essential for regulated industries

PAR is increasingly required by authorization servers in financial services, healthcare, and other high-security domains. Supporting PAR would make `@fastify/oauth2` suitable for a broader range of security-critical applications.

### Example

```javascript
// Register fastify-oauth2 with PAR support
await fastify.register(oauth2, {
name: 'oauth2Provider',
credentials: {
client: {
id: process.env.CLIENT_ID,
secret: process.env.CLIENT_SECRET
},
auth: {
authorizeHost: 'https://auth.example.com',
authorizePath: '/oauth/authorize',
tokenHost: 'https://auth.example.com',
tokenPath: '/oauth/token',
// New PAR endpoint configuration
parHost: 'https://auth.example.com',
parPath: '/oauth/par'
}
},
startRedirectPath: '/login/oauth',
callbackUri: 'https://myapp.com/login/oauth/callback',
scope: ['openid', 'profile', 'email'],
// Enable PAR for this provider
usePushedAuthorizationRequests: true
})

// When user initiates login, fastify-oauth2 would:
// 1. POST authorization parameters to PAR endpoint with client authentication
// 2. Receive request_uri from authorization server
// 3. Redirect user to authorization endpoint with only request_uri parameter

fastify.get('/login', async (request, reply) => {
// Under the hood, this would use PAR if configured
return reply.oauth2Provider.generateAuthorizationUri(request, reply)
})
```

The implementation should:
1. Add a PAR endpoint configuration option to provider credentials
2. Automatically push authorization parameters to the PAR endpoint when `usePushedAuthorizationRequests` is enabled
3. Handle client authentication during the PAR request
4. Store the returned `request_uri` and use it in the authorization redirect
5. Support the `expires_in` parameter returned by the PAR endpoint to manage `request_uri` lifecycle

### **Reference:** [RFC 9126 - OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126)
Other articles: https://www.nagarro.com/en/blog/pushed-authorization-requests-oauth-security