Server OAuth metadata hardcodes token_endpoint_auth_methods_supported, breaking public client flows #2463