As detailed in Section 10.2 of RFC 6749 (The OAuth 2.0 Authorization
Framework):
> The authorization server SHOULD NOT process repeated authorization
> requests automatically (without active resource owner interaction)
> without authenticating the client [...].

Prior to this commit, Gitea would automatically issue authorization
codes if the user previously granted access to the specific client.
Especially with pre-registered OAuth clients using loopback interface
redirects (like `git-credential-oauth`), this makes it possible for
malicious applications with access to the same loopback interface and
the ability to open a URL using the user's browser to impersonate public
clients and get access to the user's account without manual interaction.

This patch simply introduces an additional condition that prevents
automatic grants if the application is not confidential.