Reduce maximum lifetime of OAuth authorization code (10.4.3)

[randomstuff]

Current 10.4.3 reads:

10.4.3 Verify that the authorization code is short‑lived. The maximum lifetime can be up to 10 minutes for L1 and L2 applications and up to 1 minute for L3 applications.

Reading:

• this thread;
• the ConsentFix attack description;
• issue 230 on Oauth 2.1,

I think it would make sense to reduce this to 1 minutes / 30 seconds.

[elarlang]

For L1 - I don't care too much.

For L2 and L3, it is at the moment 1 minute. Is it one minute or 30 seconds? I think it is not that drastic a change to take risks down.

As reducing the time would also be a breaking change, it makes sense to follow changes in the related specs at the time when we are going to release the next major release.