fix: double-decoding of client credentials in request body

[pjcdawkins]

I noticed that client credentials are URL-decoded after being extracted from the POST body form, which was already URL-decoded by Go. The accompanying error message suggests this was copied and pasted from the HTTP basic authorization header handling, which is the only place where the extra URL-decoding was needed (as per the OAuth 2.0 spec). The result is that client credentials containing %-prefixed sequences, whether valid sequences or not, are going to fail validation.

Proposed changes

Remove the extra URL decoding. Add tests that ensure client credentials work with special characters in both the HTTP basic auth header and in the request body.

Checklist

• I have read the contributing guidelines
• I have read the security policy
• I confirm that this pull request does not address a security vulnerability.
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation within the code base (if appropriate)

[pjcdawkins]

I separated the commits just to demonstrate the test works - happy to squash if you need.

[aeneasr]

Awesome, thank you!

[aeneasr]

https://github.com/ory/fosite/releases/tag/v0.32.0

[pjcdawkins]

@aeneasr thanks for releasing, just a note the release refers to "double-encoding", that should be double-decoding