Exchange a grant for tokens

RFC 6749 section 3.2. Runs the authorization code and refresh token grants. Every client is public: it sends its client_id in the form and proves itself with PKCE, and a request that presents a client secret is refused with invalid_client (with a WWW-Authenticate: Basic challenge when it tried HTTP Basic). Body is application/x-www-form-urlencoded only; errors use the RFC 6749 section 5.2 shape, not the standard error envelope. Responses are never cacheable. Rate limited per client_id, and per client_id and address for a client id metadata URL.