OIDC Device flow must be enabled only for applications that need it.

### Is your feature request related to a problem?

Device flow may be used for a phishing attack:
1. Attacker generates URL with code
2. Sends to a victim
3. Waits for the victim to open the link
4. Runs a request to the `/application/o/token/` endpoint and receives user access token

Earlier today I created two bugs related to device flow: #20825 and #20828. As we can see, device flow with incorrect behaviour may introduce security vulnerabilities.
Enabling device flow only for the applications/provider that need it comes from the 'principle of lease privilege' and allows to reduce 'attack surface'. Other major SSO solutions like Okta and Keycloak behave in such way.

### Describe the solution you'd like

Device flow shouldn't be enabled for the whole organisation. It must be configurable per application/provider.

### Describe alternatives that you've considered

-

### Additional context

_No response_