Verify DPoP Proof public key during refresh_token grant for public clients

[jgrandja]

For public clients during the refresh_token grant flow, the DPoP Proof PublicKey must be the same as the access token PublicKey binding.

Related gh-1813