Prefer client_secret_post authentication method when available

[guillaume-fr]

No description provided.

[sbatista-uc]

What's the rationale for this PR? I'd appreciate a description or comments.

[guillaume-fr]

That was a bit ago, I'll check later if I can find context. Sorry for not clarifying that earlier.

TBH RFC6749 says:

Including the client credentials in the request-body using the two
parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
to directly utilize the HTTP Basic authentication scheme (or other
password-based HTTP authentication schemes).

It seems wiser to default to basic auth... Maybe I had encoding issues. If I can find anything I'll add a comment here.

[guillaume-fr]

Likely to be an encoding issue I had with specific server. Existing code already mention switching to post by default to avoid interoperability issues:

oauth2-client/src/client.ts

Line 149 in 8151413

* In the future, we will switch this to 'client_secret_post', which has fewer

If you think it's a good change, I can update the PR with a similar comment in code