Improve security consideration clarity for public clients

[mcguinness]

Make clear that public clients need to fallback to existing authorization code flow to Resource App to obtain user consent interactively

[sdesen]

Does this mean public clients should obtain user consent via authz_code, and then subsequently pickup this flow and make a call to the IdP? Wouldn't the authz_code flow already provide a token?

[mcguinness]

This was response to mailing list feedback

8.1 Client Authentication
This specification SHOULD only be supported for confidential clients. Public clients SHOULD redirect the user with an OAuth 2.0 Authorization Request.

Which AS are the public clients redirecting the user? How would this work? If this works, then why are needing this specification?

My attempt with the PR was to help reader understand that public client can't currently use token exchange to obtain an ID-JAG and must fall back to what they do today and redirect user to the Resource App AS to get an authorization code.

Related is #36