The code_challenge_methods_supported field is technically optional in the OIDC Discovery specification (RFC 8414, section 2). If omitted, clients should assume that plain and S256 may both be supported unless otherwise documented.