fix(auth): allow OIDC token exchange without client_secret

[claxman]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: OIDC flow fails for public clients like Azure AD B2C due to mandatory client_secret using OpenAPIToolset #2256

Problem:
create_oauth2_session with OAuth2Auth(client_id='public-client') returns (None, None). AuthHandler.generate_auth_request raises ValueError: Auth Scheme SecuritySchemeType.oauth2 requires both client_id and client_secret in auth_credential.oauth2. The issue reports Azure AD B2C public clients reject a secret.

Solution:
Require client_id only in create_oauth2_session, AuthHandler.generate_auth_request, AuthHandler._is_exchangeable, and the OpenAPI ToolAuthHandler. When client_secret is unset and the method is the default client_secret_basic, pass none into OAuth2Session. OAuth2Auth.token_endpoint_auth_method is unchanged; the session gets none when the secret is missing so users do not need a new Literal value. openid_dict_to_scheme_credential is unchanged; it is not on the issue path.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

PYTHONPATH=src .venv/bin/python -m pytest -q tests/unittests/auth/test_oauth2_credential_util.py tests/unittests/auth/test_auth_handler.py tests/unittests/tools/openapi_tool/openapi_spec_parser/test_tool_auth_handler.py tests/unittests/auth/exchanger/test_oauth2_credential_exchanger.py
83 passed, 49 warnings in 0.89s

Before the change, the same create_oauth2_session and generate_auth_request calls on main returned (None, None) and raised the ValueError quoted above.

Manual End-to-End (E2E) Tests:

Not run. No Azure AD B2C tenant available, so AADB2C90084 was not reproduced.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.