Implement the RFC9700 security recommandation about PKCE downgrade attack.

Beyond this, to prevent PKCE downgrade attacks, the authorization server MUST ensure that if there was no code_challenge in the authorization request, a request to the token endpoint containing a code_verifier is rejected.

What kind of change does this PR introduce?

Reject token requests when a code verifier is passed without a code challenge.

Does this PR introduce a breaking change?

No

Checklist

• The commits follow the conventional commits specification.
• You ran the linters with prek.
• You wrote unit test to demonstrate the bug you are fixing, or to stress the feature you are bringing.
• You reached 100% of code coverage on the code you edited, without abusive use of pragma: no cover
• If this PR is about a new feature, or a behavior change, you have updated the documentation accordingly.
• You consent that the copyright of your pull request source code belongs to Authlib's author.