This implements a per-client PKCE enforcement policy with the ability to enforce that it's used, and the specific challenge mode.