HUMAN VERIFICATION REQUIRED ASVS 10.4.12 Restrict response mode (when oauth_oidc is used)

For a given client, the authorization server only allows the 'response\_mode'value that this client needs to use. For example, by having the authorization server validate this value against the expected values or by using pushed authorization request (PAR) or JWT-secured Authorization Request (JAR).