Verify client_id_scheme rules when verifying a request

[TimoGlastra]

We just extract the needed data, and for issuance we do additional checks, but we don't do all required checks (such as checking that the client_id matches the x5c san_dns and that that in turn matches the response_uri / redirect_uri)