feat(jans-auth-server): authz challenge should not require client_id and acr_values if valid device_session is provided

[yuriyz]

Description

We should not require client_id and acr_values if valid device_session is provided.

Motivation:
Upon referencing the First Party Native Oauth RFC, it appears that a subsequent authorization request necessitates only a prompt and the device session value, as illustrated in the attached screenshot. However, when I try to remove elements like "client_id" and "acr_values" from my Postman call, I encountered an error.

Test cases and code coverage

• Write unit test to cover added/changed code
• Update integration tests to cover added/changed code
• Docs update

[yuriyz]

Feedback:

Turns out the scope is also needed in subsequent requests. Otherwise, scope-dependent variable like id_token for example, will be missing.

Step to reproduce: 1) Perform a multi-step authz challenge (omit the scope in the subsequent steps) 2) Query token endpoint with an authorization code. --> The id_token will be missing

1) Perform a multi-step authz challenge (with scope=openid in every steps) 2) Query token endpoint with an authorization code. --> The id_token will be presented