Clarify language about when client-side apps might be able to keep a secret

[jmandel]

Currently the spec says:

client-side apps (for example, HTML5/JS browser-based apps, iOS mobile apps, or Windows desktop apps) can provide adequate security – but they can’t “keep a secret” in the OAuth2 sense. That is to say, any “secret” key, code, or string that’s embedded in the app can potentially be extracted by an end-user or attacker. So security for these apps can’t depend on secrets embedded at install-time.

This doesn't directly address the case where a client-side app registers itself and obtains a unique secret (not shared with the secret installed on any other end-user's device). The phrase "embedded at install-time" implies that it might be okay to receive/embed secrets post-install, and the specification should explain this more clearly. Generally, the specification should explain if/when it's okay for a client-side app to follow SMART's confidential client spec.

@p2