Implement OAuth 2.0 Security Best Current Practice

Problem/Motivation

This will probably be a 5.3.x target, but there's no branch open for that, yet.

@e0ipso rightly pointed out in Slack that we should remove the implicit and password grant types per https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics

These individual changes address basically the same over-arching question: Should we implement the BCP document? I think the answer is "yes."

This would involve auditing the BCP draft (currently at -19) and making appropriate changes. This would include things like requiring PKCE, for instance.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes