A pushed authorization request (RFC 9126), stored by the hash of its
request_uri until the authorize endpoint consumes it, once, or it
expires. The other fields are the validated request's: extra holds
the parameters a later feature adds ("dpop_jkt", the thumbprint of
the DPoP key the code will be bound to), with string keys and JSON
values, so a store can keep it as JSON. It holds "acr_values" and
"max_age" too, when the client asks how the person must have signed
in (RFC 9470).