Restore legacy default for OAuth2 upstream auth method

[jhrozek]

Summary

#6543 added token_endpoint_auth_method to OAuth2UpstreamRunConfig so pre-registered OAuth2 upstream clients could select client_secret_basic, but it also made an unset field silently default to client_secret_basic whenever a client secret was configured. That flips every existing pre-registered upstream client with a secret from sending credentials in the token-request POST body (AuthStyleInParams, the historical behavior) to HTTP Basic auth — with no opt-in. This project does not allow backwards-incompatible changes, so rather than reverting #6543 outright, this restores the legacy default while keeping the new capability:

• buildPureOAuth2Config no longer substitutes client_secret_basic for an empty TokenEndpointAuthMethod — an unset field now stays empty, which authStyleFromMethod maps to the historical POST-body auth style, exactly as before Use Basic auth for OAuth2 upstreams #6543.
• The token_endpoint_auth_method field, its validation (validateTokenEndpointAuthMethod, isConfidentialAuthMethod, the empty-secret checks), and the CRD field exposure from Use Basic auth for OAuth2 upstreams #6543 are all kept unchanged — operators can still opt in to client_secret_basic explicitly, which was the actual fix for Pre-registered OAuth2 upstream clients never send client_secret_basic #6536.
• Updated doc comments in pkg/authserver/config.go, pkg/authserver/upstream/oauth2.go, and the operator CRD type that incorrectly described the removed implicit default, plus the docs/CRD YAML regenerated from those comments (task docs, task crdref-gen, task operator-manifests).
• Updated TestBuildPureOAuth2Config cases in embeddedauthserver_test.go to assert the restored default and added explicit coverage for both client_secret_basic and client_secret_post.

Verified the DCR path (applyResolutionToOAuth2Config) and the operator config-conversion path don't leak the same implicit-default problem — both were already correct/unaffected.

Type of change

• Bug fix

Test plan

• Unit tests (task test)

task test passes clean across the repo. TestBuildPureOAuth2Config covers: unset method + configured secret → stays empty (regression test for this fix); unset method + no secret → stays empty; explicit client_secret_post preserved; explicit client_secret_basic preserved.

API Compatibility

• This PR does not break the v1beta1 API (only doc-comment wording changed on the CRD field added by Use Basic auth for OAuth2 upstreams #6543; the field, its type, and its behavior are unchanged from that PR).

Does this introduce a user-facing change?

Yes: restores the pre-#6543 behavior for pre-registered OAuth2 upstream clients that don't set token_endpoint_auth_method — they go back to sending credentials in the token-request POST body by default, instead of #6543's silent switch to HTTP Basic auth. Operators who want client_secret_basic can still set it explicitly via token_endpoint_auth_method: client_secret_basic.

Special notes for reviewers

An independent Opus review pass confirmed the fix correctly restores the legacy default with no regressions or leaks via the DCR or operator paths, and flagged two doc-comment issues (a stale comment in config.go that still described the removed defaulting, and a duplicated/contradictory sentence in oauth2.go), both fixed here.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.97%. Comparing base (41dec70) to head (9f0f0d1).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6648      +/-   ##
==========================================
- Coverage   78.98%   78.97%   -0.01%     
==========================================
  Files         782      782              
  Lines       78067    78065       -2     
==========================================
- Hits        61660    61653       -7     
- Misses      16402    16407       +5     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.