Implementing security measures of protecting API based Authentication

[Thumimku]

Describe the issue:
This issue handle the security of the feature mentioned in #15684
This feature allows clients to efficiently access authorization endpoints and retrieve authentication criteria in an interoperable JSON format. It simplifies the user experience by seamlessly prompting users for credentials within the app's interface. This API is designed for 1st party mobile apps, bypassing explicit user consent handling. To ensure the correct app is communicating with the authorization server, Attestation of Provenance (AoP) is crucial.

Impersonation is one of the key security considerations when it comes to mobile applications. A malicious mobile app could potentially impersonate an actual app by using its client ID, then trick a user into signing in.

Apart from impersonation the following security issues are also addressed in this solution.

• Running on rooted environment
• Decompiled
• Replay Attacks on authorization server
• Man In The Middle Attack

Architecture of this feature can be found in mail : "Enhancing security measures for API based Authentication"

[Thumimku]

Working in Progress hence I extend the milesotne