Fix: OpenIdClientSettingsStep does not protect the client secret and throws null reference exceptions #18313

[mroskamp]

Fix issue where client secret was not being protected when set from OpenIdClientSettings recipe step. Fix null reference exception when Scope isn't specified in the recipe step. Fixes #18313, see #18315

[MikeAlhayek]

@mroskamp Thank you for this PR. I rather not do this. Instead, I think you'll be able to so exactly what you want using the protect method I added here https://github.com/OrchardCMS/OrchardCore/pull/19075/changes

you'll be able to do something like this instead

{
   "steps": [
      "name":"OpenIdClientSettings",
      "ClientSecret": "[js protect("OpenIdClientConfiguration","your-plain-text-secret")]",
      ...
   ]
}

[Skrypt]

I've never been able to even have this working with AutoSetup. And I believe that this should be using the Secrets module to keep this secure when pushed to a repository.