[OID4VCI] Do not bind preauthorized code to single OIDC client

Description

Currently, only the OIDC client that acquired a pre-authorized code can be used to exchange it for the access token. It assumes the issuer and wallet OIDC clients are the same clients but it is unlikely to work in prod. The wallet, when scanning a QR code with a pre-authorized code should be able to acquire a credential token without sharing the same OIDC client with the issuer.

The pre-authorized code security is hardened by the wallet user proving they have a transaction code sent to them out of band

Value Proposition

It will allow decouple wallet and issuer applications

Goals

The enhancement is about not enforcing that the client that tries to exchange the preauthorized code is the same client that acquired it. This is probably another issue, but the preauthorized code grant handler should enforce that the transaction code is supplied, by default.

Non-Goals

N/A

Discussion

No response

Notes

No response