Added dpop support for myaccount and passkeys

[rmad17]

📋 Changes

This PR carves the DPoP slice out of #116, which combined Passkey, My Account, and DPoP into one large diff. It's the third and final of three sequential branches (Passkey → My Account → DPoP), split for merge-conflict legibility — each lands as its own PR instead of one large here was reviewed there; this PR only re-sequences it.

Features

• DPoP (RFC 9449) sender-constrained tokens: new DPoPAuth auth scheme (auth_schemes/dpop_auth.py). Binds a token to an EC P-256 key your server holds, so a stolen token alone cannot be replayed.
• Opt-in on Passkey sign-in and MyAccount: every passkey and My Account method now takes an optional dpop_key. Omitting it preserves today's Bearer-token behavior with no change; supplying it attaches a DPoP proof to the request (signin_with_passkey, mfa.verify, and all seven MyAccountClient authentication-methods/factors methods).
• Nonce-challenge handling (RFC 9449 §8.2): when Auth0 responds with use_dpop_nonce and a DPoP-Nonce header, the SDK transparently rebuilds the proof with the nonce and retries once — the caller never sees the challenge.
• Bearer-downgrade rejection: if dpop_key is supplied but the server returns an unbound (Bearer) token, or vice versa, the SDK raises rather than silently accepting a token whose binding doesn't match what was requested — on signin_with_passkey (PasskeyError) and mfa.verify(MfaVerifyError).

API Changes

• New public auth scheme: DPoPAuth, exported from auth_schemes.
• New optional dpop_key: Optional[jwk.JWK] parameter on: ServerClient.signin_with_passkey, MfaClient.verify, and
  MyAccountClient.get_factors, list_authentication_methods, get_authentication_method, delete_authentication_method, update_authentication_method, enroll_authentication_method,
  verify_authentication_method.
• No new error types — DPoP-binding failures raise the existing PasskeyError / MfaVerifyError for the affected call.
• Docs: README gains a DPoP section; Passkeys.md gains "DPoP-bound passkey tokens"; MyAccountAuthenticationMethods.md gains a "DPoP" section; MFA.md gains "Verify with DPoP" for step-up.

[kishore7snehil]

LGTM!