[13.x] Force confidential PAT client

[hafezdivandari]

This PR forces personal access token grant to be confidential with the same approach as client credentials grant.

[driesvints]

@hafezdivandari could perhaps help to explain why we'd want this?

[hafezdivandari]

sure @driesvints, the "Personal access token" grant and "Client Credential" grant must be confidential, other grants confidentiality are optional, as I mentioned above the client credentials grant already has this check, but the extended PAT grant does not, we do this check on the repository but it's a good practice to also check this on grant to be consistent with the oauth server.