Merge branch 'ameya-dpop-gql' into 'master'

Enforce DPoP only on sessionless auth

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/182550



Merged-by: Drew Blessing <drew@gitlab.com>
Approved-by: Drew Blessing <drew@gitlab.com>
Reviewed-by: Drew Blessing <drew@gitlab.com>
Co-authored-by: ameyadarshan <adarshan@gitlab.com>