OAuth refresh handler should require client authentication

[hickford]

The OAuth authorization_code handler authenticates the client by validating the client secret

gitea/routers/web/auth/oauth.go

Lines 703 to 713 in 9862936

	if !app.ValidateClientSecret([]byte(form.ClientSecret)) {
	errorDescription := "invalid client secret"
	if form.ClientSecret == "" {
	errorDescription = "invalid empty client secret"
	}
	handleAccessTokenError(ctx, AccessTokenError{
	ErrorCode: AccessTokenErrorCodeUnauthorizedClient,
	ErrorDescription: errorDescription,
	})
	return
	}

According to the OAuth spec https://datatracker.ietf.org/doc/html/rfc6749#section-6 , this should also happen when "Refreshing an Access Token"

The authorization server MUST ... require client authentication for confidential clients

but handleRefreshToken doesn't do this

gitea/routers/web/auth/oauth.go

Line 658 in 9862936

func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {