Sender-constrained refresh tokens examples improvement

[sakimura]

In section 4.3.1, the current text says:

Sender-constrained refresh tokens: the authorization server cryptographically binds the refresh token to a certain client instance, e.g., by utilizing DPoP [RFC9449] or mTLS [RFC8705].

Now, according to RFC 6749 section 10.4 stats:

The authorization server MUST NOT issue refresh tokens to clients that cannot protect the confidentiality of client credentials

So, in the case of a confidential client, all refresh tokens are, in fact, sender-constrained.
I proposed to add this fact to the text. for example, changing e.g. to

e.g., issueing only to a confidential client as in [RFC6749], by utilizing DPoP [RFC9449] or mTLS [RFC8705].