Require PKCE for all clients

(with an allow-list of clients that won't support it)