HUMAN VERIFICATION REQUIRED ASVS 10.4.6 PKCE enforcement (when oauth_oidc is used)

If the code grant is used, the authorization server mitigates authorization code interception attacks by requiring proof key for code exchange (PKCE). For authorization requests, the authorization server must require a valid 'code\_challenge'value and must not accept a 'code\_challenge\_method'value of 'plain'. For a token request, it must require validation of the 'code\_verifier'parameter.