Version 1.3.0

Bug fixes

• Restore AuthorizationServer.create_authorization_response behavior, via #558 by @TurnrDev
• Include leeway in validate_iat() for JWT, via #565 by @dhallam
• Fix encode_client_secret_basic, via #594 by @Prilkop
• Use single key in JWK if JWS does not specify kid, via #596 by @dklimpel
• Fix error when RFC9068 JWS has no scope field, via #598 by @tanguilp
• Get werkzeug version using importlib, via #591 by @Sparrow0hawk

Breaking changes

• RFC9068 implementation, via #586 by @azmeuk.