clarified that redirect_uri scheme must not be used with rfc9101

[Sakurann]

resolves #392

[jogu]

The justification on the issue for this change is:

rfc9101 does not allow alg = none

However JAR does allow alg none, it's only disallowed if requred_signed_request_object is set to true in server metadata: https://www.rfc-editor.org/rfc/rfc9101.html#require_signed_request_object

[Sakurann]

@jogu
so you are suggesting when using JAR with client id scheme redirect_uri, alg = none must be used?
isn't prohibiting using JAR with client id scheme redirect_uri safer and more in spirit of sentiment around alg=none ?
and I do worry that allowing JAR with alg=nonce with client_id_scheme redirect_uri would encourage implementers to unnecessarily use it.

[jogu]

My thinking didn't go as far as a suggestion, it was more at the "if we're making a breaking change to the spec we should make sure we have a clear correct reason for doing so" level.

I hate alg=none as much as everyone else. The conformance suite does support alg:none here (it calls it "request_uri_unsigned" in the dropdown choice) and I can see over the past few months a few people have used it with redirect_uri client scheme, though whether they did so 100% intentionally I'm not sure, at least a few of the tests did pass so people support it.

I guess if we do want to discourage alg=none, we should do that consistently across all client id schemes?

[awoie]

I agree with @jogu. I believe this is what some people are using and we never disallowed that.