fix: Prevent DPoP replay protection error due to OkHttp retry

[pmathew92]

Description

This PR introduces a dual-client architecture in DefaultClient to prevent OkHttp from automatically retrying network requests that use DPoP (Demonstrating Proof-of-Possession). DPoP proofs contain unique, non-replayable tokens (jti claims and timestamps), and OkHttp's automatic retry mechanism can cause "proof already used" errors when the same proof is sent twice.

Changes

Core Implementation (DefaultClient.kt)

• Added nonRetryableOkHttpClient property with retryOnConnectionFailure = false

Testing

All tests pass successfully

./gradlew auth0:testDebugUnitTest

[Copilot]

Pull request overview

This PR introduces a dual-client architecture in DefaultClient to prevent OkHttp's automatic retry mechanism from causing DPoP (Demonstrating Proof-of-Possession) replay protection errors. DPoP proofs contain unique, non-replayable tokens, and when OkHttp retries a request with the same proof, the server returns a "proof already used" error.

Changes:

• Added nonRetryableOkHttpClient property that shares configuration with the main client but has retryOnConnectionFailure set to false
• Implemented shouldUseNonRetryableClient() method to detect DPoP requests by checking for the DPoP header
• Modified prepareCall() to select the appropriate client based on the presence of the DPoP header

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
auth0/src/main/java/com/auth0/android/request/DefaultClient.kt	Adds dual-client architecture with non-retryable client for DPoP requests, includes client selection logic based on DPoP header presence
auth0/src/test/java/com/auth0/android/request/DefaultClientTest.kt	Adds 2 configuration tests verifying both clients exist with correct settings and share the same configuration

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[NandanPrabhu]

do we have other conditions too for which non retryable client must be used?

[pmathew92]

Currently Dpop scenario is where this is causing major error. We can update these cases on need to basis like refresh token exchange etc