Recommend usage of PKCE in the README

[gaeljw]

Hello folks,

It seems that PKCE is almost always enabled by default nowadays on OIDC provider side. Even if PKCE is not forced on the server side for the client, it is used if possible (possible = the metadata exposed by the provider say so and the client is compatible).

Then, shouldn't the documentation of kubelogin be updated to reflect that the most of the time the client-secret is not required?

And maybe add a section "what if I cannot use PKCE?" that gives an example with the client-secret.

And/or mention the usage of --oidc-use-pkce that forces PKCE.

Related to:

• Is distributing client-secret insecure in any way? #414
• Any way to use public oidc client / implicit flow #1173