Support `private_key_jwt` client authentication for custom OIDC providers

Problem Custom OIDC providers (POST /admin/custom-providers) can only authenticate to the provider's token endpoint with a client_secret (client_secret_basic / client_secret_post). There is no way to use private_key_jwt ([RFC 7523]( [OIDC Core §9]( Many regulated IdPs only accept asymmetric client authentication: healthcare and government identity providers, and anything following FAPI 2.0, which does not allow shared secrets. For those IdPs, the custom provider feature cannot be used at all. Reproduction Tested against supabase/gotrue:v2.196.0, with a mock OIDC provider whose token endpoint only accepts private_key_jwt: 1. The provider registers fine. The discovery document advertises token_endpoint_auth_methods_supported: ["private_key_jwt"], but that field is not kept in the stored discovery_document, and the admin API has no parameter to set the auth method. 2. At /callback, GoTrue sends client_secret_basic, then retries with client_secret_post. It never sends …