Be prescriptive on how client authentication is used

[PieterKas]

If client authentication is used, don't ship client secrets in the binary. e.g. use dynamic client registration instead. Look at what PAR and ensure it can be used here.

[gffletch]

Maybe just put a link to best practices for native apps spec.

[aaronpk]

Covered in Client Authentication section in Security Considerations https://aaronpk.github.io/oauth-first-party-native-apps/draft-parecki-oauth-first-party-native-apps.html#name-client-authentication