OIDC discovery document advertises "id_token" response_type that /authorize does not support #39482

Gitea Version

gitea version e0095af built with go1.27.1

What happened?

The OIDC discovery document does not match the actual capabilities of the /login/oauth/authorize endpoint.

1. What the discovery document claims

GET /.well-known/openid-configuration returns:

"response_types_supported": ["code", "id_token"]

This tells any OIDC client that both the authorization code flow (response_type=code) and the implicit flow (response_type=id_token) are supported.

Source: https://github.com/go-gitea/gitea/blob/main/routers/web/auth/oauth2_wellknown.go#L32-L35

2. What the authorize endpoint actually does

/login/oauth/authorize rejects anything other than response_type=code:

if form.ResponseType != "code" {
    handleAuthorizeError(ctx, AuthorizeError{
        ErrorCode:        ErrorCodeUnsupportedResponseType,
        ErrorDescription: "Only code response type is supported.",
        State:            form.State,
    }, form.RedirectURI)
    return
}

Source: https://github.com/go-gitea/gitea/blob/main/routers/web/auth/oauth2_provider.go#L261-L268

3. Additional confirmation

The same discovery document's grant_types_supported only lists authorization_code and refresh_token — implicit is absent, confirming the implicit/hybrid flow was never implemented.

Expected behavior: response_types_supported should only list values the authorize endpoint actually accepts.

Actual behavior: Discovery claims id_token is supported, but requesting it fails with unsupported_response_type and no id_token is ever issued.

Impact: OIDC client libraries that read the discovery document to decide which flow to use (instead of hardcoding response_type=code) may attempt the implicit flow and fail — this could be the root cause behind reports like #38414, where users say Gitea "won't return an id_token."

Suggested fix: Remove "id_token" from response_types_supported in routers/web/auth/oauth2_wellknown.go, since only the authorization code flow is implemented.

Steps to reproduce (verified locally):

1. Built and ran Gitea from source (make backend + ./gitea web), completed setup with SQLite.
2. Registered an OAuth2 Application under Site Administration → Applications and obtained a client_id.
3. Ran curl http://localhost:3000/.well-known/openid-configuration — confirmed response_types_supported includes id_token.
4. While logged in, opened http://localhost:3000/login/oauth/authorize?client_id=<CLIENT_ID>&redirect_uri=<REDIRECT_URI>&response_type=id_token&state=xyz.
5. Got redirected to <REDIRECT_URI>?error=unsupported_response_type&error_description=Only+code+response+type+is+supported.&state=xyz, confirming discovery is inconsistent with actual behavior.

I'd like to work on this: remove "id_token" from response_types_supported, and add/extend an integration test in tests/integration/oauth_test.go asserting response_type=id_token is rejected consistently. Happy to submit a PR if this issue can be assigned to me.