Create an API client

Creates an ACTIVE client with its first secret and deploys it to the gateways (201 + Location). Requires the Idempotency-Key header; the client id is minted when the body leaves it blank. The first secret is the body's secret (the shape of POST .../secret-versions) or, when absent, a generated one; a GENERATED value is returned once, under no-store, and never again. A public client (tokenEndpointAuthMethod=none) is created active without a secret; a secret sent with it is refused.