This pull request brings a few refactoring and the implementation for RFC 9101
The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR).

To summarize, RFC9101 is about passing the authorization request payload in a JWT, called request object, instead of passing it in the request body or query string. The request object is passed in a request parameter or hosted at the client and the URI to the request object is passed in a request_uri parameter.

To achieve this I had to perform some refactoring, and deprecate some usage with planned removal for Authlib 1.7 (so we can release 1.6 including this PR).

• The hook mechanism has been reworked, and the execute_hook method is replaced by a hooked decorator. This helps catching a method result every time when several return calls are in the method. There is no deprecation for hooks as I considered it is Authlib private API.
• A AuthorizationServer extension mechanism is introduced, and the RFC9207 IssueParameter is now an authorization server extension instead of a grant extension. Using IssueParameter as a grant extension is tolerated until 1.7.
• The create_authorization_response takes a grant parameter. This is to avoid calling get_consent_grant twice, which can be costly when a network request is performed to reach the request_uri endpoint. The parameter is optional at the moment but will become mandatory with 1.7.
• The OAuth2Request has been split in another OAuth2Payload class. This help separate the request object and the request payload, so the rfc9101 extension can overwrite the request payload with the request object content. Properties like request.data are deprecated in favor of request.payload.data and will be removed in 1.7.

Fixes #723