[ABCA] Implement Refresh Token Binding

[Awambeng]

Description

This is a proxy of:

• [ABCA] Implement Refresh Token Binding keycloak/keycloak#44771

Bind refresh tokens to the client instance key used for attestation.

Potential considerations

• On token issuance, bind refresh token to cnf.jwk public key
• On refresh request, verify the same key is used
• Reject refresh requests from mismatched keys with invalid_client_attestation
• Ensure PoP + Attestation validation applies to refresh flows
• Add necessary fields to token/session model

estimated time: 2–3 days