Client ID not required for PKCE refresh, despite documentation

[felix-hilden]

Hi, despite being documented as a required field, refresh requests with PKCE token refresh tokens are accepted and refreshed without it, if a `b64(id:secret)` authentication pair is present. Additionally the relevant RFC states nothing about refreshing being affected, at least I didn't spot anything.

Is it intended behaviour that PKCE tokens can be refreshed using the ordinary method, but not the other way around?

[felix-hilden]

Basically both types of user tokens can be refreshed using the same original refresh call now. However, ordinary user tokens cannot be refreshed using the PKCE version with Client ID.