allowPushedAuthorizationRequestFallback

Allows browser-based authorization flows to fall back to the classic authorization request URL when PAR is optional but unavailable or the push request fails.

Disabled by default (fail-closed): a PAR failure surfaces as a thrown exception (e.g. oauth2's AuthorizationCodeFlow.PushedAuthorizationRequestException) from the calling flow, rather than silently downgrading to a request that omits PAR's replay/tampering protections. Set to true to allow that downgrade instead — note that the PAR failure's cause is not otherwise surfaced (no logging or event) when the fallback succeeds, so this is an explicit trade of visibility for availability.