fix(endpoint-auth): bind code exchange to the code’s own claims, not application state

[rmdes]

Fixes #892.

codeValidator took the client an authorization code was issued to from
request.app.locals.client. That is application-wide state, holding whichever
authorization request last reached the server, so it can be absent (500) or
refer to a different client than the one the code was issued to (a code
redeemable by another client).

The change

Verify the code first, then compare the request against the claims it carries:

request.verifiedToken = verifyToken(code);

if (!request.verifiedToken.client_id || !request.verifiedToken.redirect_uri) {
  throw IndiekitError.unauthorized(__("UnauthorizedError.invalidToken"));
}

if (getCanonicalUrl(client_id) !== getCanonicalUrl(String(request.verifiedToken.client_id))) { … }
if (redirect_uri !== request.verifiedToken.redirect_uri) { … }

consent.js:82 already signs both into the code, so nothing new has to be
recorded. PKCE now keys off the challenge in the code rather than
app.locals.usePkce, which removes the last read of application state here.

validateRedirect is no longer called at redemption: redirect_uri is
validated against the client's metadata during the authorization request, so
what remains is matching the value the code was issued for. That is a behaviour
change worth a look — it trades a network-dependent check for an equality one.

Tests

Two added, both failing on main:

• 401-token-grant-no-authorization-request.js — an exchange with no preceding
  authorization request. main returns 500 with a TypeError.
• 401-token-grant-code-issued-to-other-client.js — a code issued to one
  client, redeemed by another that began its own authorization request first.
  main returns 200 with an access token.

Seven existing tests signed codes carrying neither client_id nor
redirect_uri, which consent.js cannot produce, so they exercised codes that
cannot occur. They now sign the claims a real code carries. Two of them —
invalid client_id and invalid redirect_uri — assert the same statuses and
messages as before, now reached through the code's claims rather than through
app.locals.

node --test in packages/endpoint-auth: 68 tests, 68 passing. Reverting
only code.js and keeping the tests fails exactly the two new ones. main is
66/66 before this change.

Relationship to the other open branches

Independent of #884, #887 and #889. This branch is cut from main, as is #891,
and both change packages/endpoint-auth/lib/middleware/code.js.

I described that overlap as a trivial rebase when opening this. Having since
merged the two locally, that was understated, so to correct it: code.js does
merge cleanly — #891 adds a grant_type allowance to the required-parameter
list, this one replaces the checks that follow it, and git resolves that without
conflict. But the merged result fails a test, and it is #891's own:

200-authorization-profile-no-grant-type.js, added there, signs a code with
neither client_id nor redirect_uri — the same gap as the seven fixtures this
PR updates. It passes on either branch alone and fails on both together, because
this PR starts rejecting codes missing those claims. Adding them to that fixture
resolves it, after which the combined branches give 70 tests, 70 passing.

So whichever merges second needs a one-line fixture change as well as the merge,
and CI on the second branch will go red until it is made. Nothing structural —
but it will not go green on the merge alone, which is what "trivial rebase"
implied.