Update the Pro Santé Connect provider to make the client certificate setting required

[kevinchalet]

Confirm you've already contributed to this project or that you sponsor it

• I confirm I'm a sponsor or a contributor

Describe the solution you'd like

Using mTLS is now mandatory for the sandbox environment and will be required for the production environment in late 2024, as indicated in https://industriels.esante.gouv.fr/produits-et-services/pro-sante-connect/documentation-technique. Since it will stop working with a client certificate after this date, we'll likely want to make it a mandatory setting in OpenIddict.

Additional context

No response

[kevinchalet]

Adding mTLS support to the client stack is tracked by #2186.

[kevinchalet]

mTLS is now fully supported by the client stack and was successfully tested against Keycloak.

Note: when making the switch, we'll also need to tweak this handler to remove the client_secret_* methods from the supported client authentication methods list if PSC doesn't update their configuration document to reflect this change:

openiddict-core/src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.Discovery.cs

Lines 341 to 357 in 9f613b1

	// Pro Santé Connect lists private_key_jwt as a supported client authentication method but
	// only supports client_secret_basic/client_secret_post and tls_client_auth and plans to
	// remove secret-based authentication support in late 2024 to force clients to use mTLS.
	else if (context.Registration.ProviderType is ProviderTypes.ProSantéConnect)
	{
	context.Configuration.DeviceAuthorizationEndpointAuthMethodsSupported.Remove(
	ClientAuthenticationMethods.PrivateKeyJwt);
	context.Configuration.IntrospectionEndpointAuthMethodsSupported.Remove(
	ClientAuthenticationMethods.PrivateKeyJwt);
	context.Configuration.RevocationEndpointAuthMethodsSupported.Remove(
	ClientAuthenticationMethods.PrivateKeyJwt);
	context.Configuration.TokenEndpointAuthMethodsSupported.Remove(
	ClientAuthenticationMethods.PrivateKeyJwt);
	}