feat: client secret handling flag

[beubax]

Description

Added support for alternative client secret authentication methods. Specifically:

• Introduced a new client_secret_handling setting (with "post" and "basic" options) in OAuthConfig.
• Configured Notion and X (Twitter) providers to use "basic" client secret handling.
• Updated authentication flows (pkce, dcr_pkce, device_code, base refresh/revoke) to conditionally send client credentials via HTTP Basic Auth or form-encoded POST body.

Motivation and Context

Notion and X (Twitter) token exchange endpoints require credentials to be sent using HTTP Basic Authentication (client_secret_basic) rather than in the standard request body. Without this, token exchanges with these providers fail with a 401 Unauthorized error.

How Has This Been Tested?

• Verified with the test suite: ran uv run pytest (all tests passing).
• Validated code style and formatting using uv run ruff check and uv run ruff format.
• Verified type correctness using uv run ty check.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• I have read the CONTRIBUTING document.
• All new and existing tests passed.