HUMAN VERIFICATION REQUIRED ASVS 10.4.14 Proof-of-possession tokens (when oauth_oidc is used)

The authorization server issues only sender-constrained (Proof-of-Possession) access tokens, either with certificate-bound access tokens using mutual TLS (mTLS) or DPoP-bound access tokens (Demonstration of Proof of Possession).