Blazor ROPC

[guardrex]

Fixes #33744
Fixes #33784

I needed a special INCLUDE for Blazor to distinguish between client-side/SPA and server-side Blazor projects. I also prefer to use the word "project" in the BWA/server-side context over "app" because BWA/hosted WASM is a solution of two or more projects that have different security requirements.

---

Internal previews

Toggle expand/collapse

📄 File	🔗 Preview link
aspnetcore/blazor/blazor-ef-core.md	aspnetcore/blazor/blazor-ef-core
aspnetcore/blazor/components/data-binding.md	aspnetcore/blazor/components/data-binding
aspnetcore/blazor/security/blazor-web-app-with-oidc.md	aspnetcore/blazor/security/blazor-web-app-with-oidc
aspnetcore/blazor/security/index.md	aspnetcore/blazor/security/index
aspnetcore/blazor/security/server/account-confirmation-and-password-recovery.md	aspnetcore/blazor/security/server/account-confirmation-and-password-recovery
aspnetcore/blazor/security/server/index.md	aspnetcore/blazor/security/server/index
aspnetcore/blazor/security/webassembly/index.md	aspnetcore/blazor/security/webassembly/index
aspnetcore/blazor/security/webassembly/standalone-with-identity.md	aspnetcore/blazor/security/webassembly/standalone-with-identity
aspnetcore/blazor/tutorials/movie-database-app/part-1.md	aspnetcore/blazor/tutorials/movie-database-app/part-1
aspnetcore/blazor/tutorials/movie-database-app/part-2.md	aspnetcore/blazor/tutorials/movie-database-app/part-2
aspnetcore/blazor/tutorials/movie-database-app/part-4.md	aspnetcore/blazor/tutorials/movie-database-app/part-4

[Rick-Anderson]

A++ work as usual for you.

[guardrex]

I think we'll go ahead and merge this tomorrow (Monday) EOD. I think the only significant question is on if env vars offer enough protection for test/staging. Right now, the updates on this PR advise not to use them except in local dev testing, along with the Secret Manager tool.

[guardrex]

BTW ... As soon as this goes in, I'll be updating the BWA+OIDC sample app and article with guidance to use the Secret Manager tool for the client secret. Tracked by 👉 #33804.

As for the upcoming BWA+Entra sample app and article, it will be set up in the PR that establishes the article.

[guardrex]

@Rick-Anderson ... Try it now. I ended up using "recommendation" language similar to what you used on your PR.