feat: add support for backchannel authentication

[guabu]

📋 Changes

Adds support for Client-Initiated Backchannel Authentication. A new method backchannelAuthentication is exposed on the client that enables developers to initiate a backchannel authentication request and poll the token endpoint until it's complete.

The openid-client was added to handle the polling and retry logic without having to re-implement it ourselves using oauth4webapi and to start moving the implementation closer to that of auth0-auth-js.

🎯 Testing

1. Call the backchannelAuthentication method from a server route/action
2. Authorize or reject the authorization via a Guardian app
3. The SDK will return the token set or error accordingly

[adamjmcgrath]

The openid-client was added to handle the polling and retry logic without having to re-implement it ourselves using oauth4webapi and to start moving the implementation closer to that of auth0-auth-js.

Would it make more sense to use auth0-auth-js for CIBA now if that's what the sdk is going to end up using?

[codecov-commenter]

Codecov Report

❌ Patch coverage is 89.78102% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.61%. Comparing base (0e83495) to head (6d33068).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
src/server/auth-client.ts	93.63%	7 Missing ⚠️
src/server/client.ts	12.50%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2261      +/-   ##
==========================================
+ Coverage   85.39%   85.61%   +0.21%     
==========================================
  Files          26       26              
  Lines        2471     2606     +135     
  Branches      462      477      +15     
==========================================
+ Hits         2110     2231     +121     
- Misses        355      369      +14     
  Partials        6        6              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tusharpandey13]

Errors that come from Auth0 in the redirect_uri callback may contain reflected user input via the OpenID Connect error and error_description query parameter. You should not render the error message, or error and error_description properties without properly escaping them first.

See

nextjs-auth0/src/errors/index.ts

Line 7 in b685e5c

* You should **not** render the error `message`, or `error` and `error_description` properties without properly escaping them first.

[tusharpandey13]

Is passing e.error_description safe here?

[tusharpandey13]

Do we think that exporting openid-client polling configuration can be useful here instead of hardcoding the default config?
https://github.com/panva/openid-client/blob/main/docs/interfaces/BackchannelAuthenticationGrantPollOptions.md

[tusharpandey13]

Authenticates using Client-Initiated Backchannel Authentication and returns the token set and optionally the ID token claims and authorization details.

Should this be named as authenticateWithBackchannel instead?