forbid password grant type in HEART mode

Author: jricher

openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/DefaultOAuth2ClientDetailsEntityService.java

@@ -272,6 +272,10 @@ private void checkHeartMode(ClientDetailsEntity client) {
 
 }
 
+if (client.getGrantTypes().contains("password")) {
+throw new IllegalArgumentException("[HEART mode] Password grant type is forbidden");
+}
+
 // make sure we don't have a client secret
 if (!Strings.isNullOrEmpty(client.getClientSecret())) {
 throw new IllegalArgumentException("[HEART mode] Client secrets are not allowed");