[BUG] OAuth2 client registration and subsequent requests use inconsistent authentication methods when OAuth2 authorization server supports client_secret_post

Introduction

There are two OAuth2 client-to-authorization-server authentication methods that do the same thing: client_secret_basic and client_secret_post. The former uses the Authorization: Basic header, while the latter puts the data in the body.

Actual behaviour

OAuth2 client registration and subsequent requests use inconsistent authentication methods, when the OAuth2 authorization server supports client_secret_post.

1. Without checking any server capabilities, the app registers an OAuth2 client that uses client_secret_basic.
   https://github.com/owncloud/android/blob/36ef69e3f1fac55eba935d7ca713b4fbfb4b9b33/owncloudTestUtil/src/main/java/com/owncloud/android/testutil/oauth/ClientRegistrationRequest.kt#L28
2. The app then acts as this OAuth2 client, but instead speaks client_secret_post after checking that the server supports it. Otherwise it speaks client_secret_basic. If a server supports both, then client_secret_post is used. Keycloak supports both, but now requires that, if a client registered with client_secret_basic, it must keep using client_secret_basic, even if the authentication details are the same. As a result, adding an account fails 100% of the time on the latest Keycloak.
   https://github.com/owncloud/android/blob/36ef69e3f1fac55eba935d7ca713b4fbfb4b9b33/owncloudApp/src/main/java/com/owncloud/android/presentation/authentication/LoginActivity.kt#L670 https://github.com/owncloud/android/blob/36ef69e3f1fac55eba935d7ca713b4fbfb4b9b33/owncloudApp/src/main/java/com/owncloud/android/presentation/authentication/AccountAuthenticator.java#L378

Expected behaviour

The OAuth2 client authentication methods are used consistently.

Proposed fix: move server capability check to the client registration step, and persist client_secret_basic or client_secret_post.
There is no other good way to ensure the required consistency.

Steps to reproduce

Use an installation with the latest Keycloak (I can give you an account)

Environment data

Android version: 17

Device model: Pixel 10

Stock or customized system: stock

ownCloud app version: 4.8.1

ownCloud server version: 8.0.2 (irrelevant)

Logs

Web server error log

Keycloak records a client authentication failure event

ownCloud log (data/owncloud.log)

No significant request has hit ownCloud yet

Start by tracing client registration in owncloudTestUtil/src/main/java/com/owncloud/android/testutil/oauth/ClientRegistrationRequest.kt, then compare the authentication selection in LoginActivity.kt and AccountAuthenticator.java. Done means registration and subsequent requests persist and use the same client authentication method, including against a server supporting both methods.