fix(client): apply every mTLS endpoint alias, whatever the reason for mutual TLS

[osanderson]

Summary

What RFC 8705 §5 requires. A client "intending to do mutual TLS (for OAuth client authentication and/or to acquire or use certificate-bound tokens) when making a request directly to the authorization server MUST use the alias URL of the endpoint within the mtls_endpoint_aliases, when present."

client.MTLSEndpoints split the aliases by purpose instead, and each helper missed one endpoint:

Helper	Moved	Missed
ApplyForClientAuth	Token, PAR, revocation	CIBA backchannel authentication. CIBA Core §7.1 requires the client to authenticate there with its registered method, so a certificate-authenticated CIBA client sent its request to the plain endpoint.
ApplyForSenderConstrain	Token, CIBA, revocation	PAR

The fix:

• Both helpers now apply every advertised alias (token, PAR, backchannel authentication and revocation) through one shared function.
• The authorization endpoint is never aliased, because the browser calls it, not the client.
• Callers keep calling whichever helper they did. A client doing both kinds of mTLS needs only one call.
• The mTLS guide's snippet and the conformance client's comment are updated to match.

This follows #550, which fixed the revocation case of the same split.

Verification

• Test: a new test runs both helpers and expects every alias applied, with the authorization endpoint untouched. The nil-receiver and partial-alias tests are unchanged.
• Mutation checks: dropping any one of the four aliases makes the test fail.
• Builds and suite: go vet, the full test suite, golangci-lint, the conformance client's build and the payroll-run demo's build are all clean.
• Conformance: the full suite is being run against this branch. Its mTLS configurations exercise servers with and without aliases.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud