feat: show PKCE and nonce settings on applications and warn when both are off #337

Why

An OpenID Provider application can now turn off PKCE (pkceRequired: false, confidential clients only) and then the nonce requirement too (nonceRequired: false), see fells-code/seamless-auth-api#539. With both off, the application relies on state and client authentication alone against authorization code injection.

What

• Show pkceRequired and nonceRequired when inspecting an application, and accept them when creating or updating one.
• Print a warning whenever an application has both off: on create or update, and when listing or inspecting it.

Done when

The CLI reports both settings and warns about an application with both off.