feat: support compliant machine-only FAPI profiles

[greg6775]

Summary

• allow FAPI 2 providers that expose only machine-to-machine grants instead of requiring authorization_code
• when authorization_code is enabled, require code-only response types, PAR, PKCE S256, issuer response parameters, and a PAR lifetime below 600 seconds
• enforce required RFC 8707 resources for client_credentials
• validate configured resource indicators as unique absolute URIs without fragments and defensively copy configuration
• return unauthorized_client as HTTP 400 at the token endpoint without changing protected-resource 401 behavior

Verification

• go test ./...
• go test -race ./internal/token ./pkg/provider ./pkg/goidc ./internal/userinfo
• go vet ./...
• golangci-lint run
• git diff --check

References: FAPI 2.0 Security Profile, RFC 8707, and RFC 6749 token endpoint error semantics.