feat: reject secret creation and fix reporting for public clients - #28097

Fourth in the stack splitting up #27873 (public OAuth2 clients), on top
of #28047. Closes two remaining gaps beyond registration and the token
endpoint: the admin/API surface for managing client secrets, and what
auth method Coder reports back to a client whose stored method and
client_type disagree.

CreateAppSecret now rejects minting a secret for a public client
(RFC 7591 §2, OAuth 2.1 §2.1: a public client authenticates with PKCE
alone). Without this, an operator could create a secret the token
endpoint never validates, and deleting it would look like a kill
switch while revoking nothing, since a public client's tokens carry a
NULL app_secret_id.

reportedAuthMethod() normalizes what token_endpoint_auth_method
CreateDynamicClientRegistration, GetClientConfiguration, and
UpdateClientConfiguration report back for a client whose stored method
and client_type disagree. This only arises for clients registered
before client_type was derived from the method: such a row is stored
confidential with a method of "none", and reporting "none" verbatim
would tell the client to drop a secret its exchange still requires.
Reporting the enforced behavior instead means the client's next PUT
repairs the mismatch on its own.