Reinstate the check on the 'ath' claim in dpop validation

[ylebre]

The current implementation allows the 'ath' claim to be missing. This is done for backwards compatibility with client libraries that do not have this claim in the token.

The 'ath' claim was not part of the original dpop specification draft (https://datatracker.ietf.org/doc/id/draft-ietf-oauth-dpop-01.html section 4.2), but is part of the current draft (https://datatracker.ietf.org/doc/id/draft-ietf-oauth-dpop-11.html at the time of this issue).

When client implementations have caught up with the ath claim, we should start checking for this claim again to align with the newer version of the draft specs.

[Potherca]

Suggested plan of attack:

• Create ath fix branch
• Shortlist application we feel we should support
• Research / Test each application against an instance with the ath fix
• Open MRs to fix any failing apps (most likely updating used libs sould be enough)
• Merge / Deploy the ath fix branch to main

[Potherca]

Apps shortlist:

• PodPro
• Solid Migrator
• Media Kraken / Umai / Solid Focus (all use the same lib by Noel de Martin)
• Penny
• Dokeli
• Solid Launcher / Solid Contacts / etc. (all use the same Metro lib)

Others? (for instance from https://solidproject.org/apps)