Accept OIDC token request extensions sent by OmniAuth

Investigate and fix invalid_request during Kaukus code redemption. Local synthetic grants show codes issued but not redeemed. Read-only inspection of Kaukus devise configuration and installed omniauth_openid_connect 0.8.0/rack-oauth2 2.3.0 shows default send_scope_to_token_endpoint=true, while provider TokenInput denies unknown fields. Reproduce extra scope/extension rejection, accept unrecognized token request parameters without granting scopes/audiences not bound to the authorization code, retain duplicate-known-field rejection, and explicitly reject client_secret_post/multiple-auth-method use. Preserve confidential Basic auth and mandatory PKCE. Add scoped HTTP and standards-library browser regressions and update docs. Do not edit Kaukus or read real client credentials. Verified outcome: a new regression reproduced HTTP 400 for an otherwise valid token request carrying OmniAuth-style scope and an extra resource parameter. Removed deny_unknown_fields from TokenInput so unrecognized token extensions are ignored; issued scopes and UserInfo claims still come only from the stored authorization grant. Explicitly parse/zeroize/reject body client_secret to preserve the unsupported client_secret_post/multiple-auth-method boundary. Known-field duplicates remain rejected. Tests cover attempted scope/refresh/audience expansion, Basic-plus-body-secret rejection, ordinary body-secret rejection and continued redeemability after malformed attempts. Standards-library browser tests now send scope plus an ignored extension for both client types, matching the inspected Ruby gem's request shape. Kaukus configuration and installed gem sources were inspected read-only; no app files or real credentials were modified/read. Validation passed: fmt, strict Clippy, cargo test --workspace --all-features, python3 dev/run.py test (all eight OIDC integration tests), and the focused oidc_relying_party_browser test (both client types, light/dark, JS on/off). Full preview/admin browser suite was not rerun for this parser-only follow-up; it passed before this change. Updated docs/oidc.md. Actual interactive Kaukus login is still for the user to retry with a fresh authorization attempt after provider reload; do not claim that application login was verified. Changes are uncommitted.