Urlencode client_id and client_secret

[ThomasRigoni7]

From RFC 6749 on Oauth2, section 2.3.1:

Clients in possession of a client password MAY use the HTTP Basic
authentication scheme as defined in [RFC2617] to authenticate with
the authorization server. The client identifier is encoded using the
"application/x-www-form-urlencoded" encoding algorithm per
Appendix B, and the encoded value is used as the username; the client
password is encoded using the same algorithm and used as the
password.

This means that we should first apply urlencoding to client_id and secret, then pass them to basic auth.

Testing locally with Keycloak, a client secret that includes a + character is not able to successfully login, as whitespaces are replaced with + in urlencode. When that + character is converted into %2B, then authentication succeeds.