Do not show the user code on Device Authorization Grant consent screen when user code pre-fill was not used

[hughns]

Is your feature request related to a problem? Please describe.
The MAS device code consent screen always shows the user code (labelled as "security code". It looks like similar to this:

The requirement to show it comes from RFC 8628 3.3.1:

If the user starts the user interaction by navigating to "verification_uri_complete", then the user interaction described in Section 3.3 is still followed, with the optimization that the user does not need to type in the "user_code". The server SHOULD display the "user_code" to the user and ask them to verify that it matches the "user_code" being displayed on the device to confirm they are authorizing the correct device.

However, MAS currently shows the user code even if the verification_uri (i.e. without user code) was used or if the code= parameter was ignored with the oauth.device_code_user_code_auto_fill_enabled=false configuration option.

Describe the solution you'd like

If either:

• verification_uri was used
• device_code_user_code_auto_fill_enabled=false

then do not show the "security code" on the consent screen because the user had to enter it on the previous screen.

Describe alternatives you've considered
This is a minor UX optimisation, so the alternative considered is to leave it as is.

Additional context
None

Credit to @pixlwave for suggesting.