fix(coderd/oauth2provider): support client_secret_basic client auth (#21793)

coderd/httpmw/oauth2.go

@@ -329,6 +329,13 @@ func extractOAuth2ProviderAppBase(db database.Store, errWriter errorWriter) func
 						paramAppID = r.Form.Get("client_id")
 					}
 				}
+				if paramAppID == "" {
+					// RFC 6749 §2.3.1: confidential clients may authenticate via
+					// HTTP Basic where the username is the client_id.
+					if user, _, ok := r.BasicAuth(); ok && user != "" {
+						paramAppID = user
+					}
+				}
 				if paramAppID == "" {
 					errWriter.writeMissingClientID(ctx, rw)
 					return