Support for RFC 9207 - OAuth 2.0 Authorization Server Issuer Identification

[ThisIsMissEm]

This document specifies a new parameter called iss. This parameter is used to explicitly include the issuer identifier of the authorization server in the authorization response of an OAuth authorization flow. The iss parameter serves as an effective countermeasure to "mix-up attacks".

RFC 9207

I'd advocate for supporting this, since it prevents mix-up attacks as noted in OAuth 2.0 Security Best Current Practices.

This would require additional configuration of an issuer which defaults to the root_url for the Rails App. It would also require #1587.

I would be interested in implementing both in Doorkeeper if there is interest in receiving pull requests for these.