Docs on DPoP in AccessTokenManagement + private_key_jwt (and/or JAR)

[maartenba]

Both ATM's DPoP code and user code for private_key_jwt use the same OIDC events. User code might set an event type in the OIDC options to create request objects and assertions, but then the ATM internals that set up DPoP via IConfigureNamedOptions override that by creating event callbacks to set up and use a DPoP key.

Example workaround: https://github.com/DuendeSoftware/products/pull/2160/files#diff-82adcb37e692ba7ea28f981722ee494d41704b43159e5ed3c429bb7ca2e31ad1R10

Please double check with @josephdecock