Note to reviewer: pr is best reviewed commit by commit

While implementing this
I realised two things are missing

1. verification_uri_complete isn't being passed to the endpoint
2. The server kwargs aren't being passed to the device code grant

Explanation of 2:

oauthlib assumes code like so for adding custom validators (or rather, examples in the code base do this but the constructor of a grant allows for generic kwargs to be passed in to set it up)

auth = DeviceCodeGrant(validator)

auth.custom_validators.pre_token.append(pre_token_validator)
auth.custom_validators.post_token.append(post_token_validator)

However there are cases where one would want more flexibility. What do I mean flexibility? All grant's inherit from GrantTypeBase and have a constructor like:

    def __init__(self, request_validator=None, **kwargs):
        self.request_validator = request_validator or RequestValidator()
        self._setup_custom_validators(kwargs)

    def _setup_custom_validators(self, kwargs):
        post_auth = kwargs.get('post_auth', [])
        post_token = kwargs.get('post_token', [])
        pre_auth = kwargs.get('pre_auth', [])
        pre_token = kwargs.get('pre_token', [])
        self.custom_validators = ValidatorsContainer(post_auth, post_token,
                                                     pre_auth, pre_token)

One might want to pass in any combination of the custom validators to the Server that uses the Grant object as a generic dict of server kwargs (like is done in django-oauth-toolkit in order to abstract oauthlib away)

By allowing this it makes it easier to set up the validator checks

But what were you even trying to do in the first place?

For the device code this means being able to pass in a validation callable in a more flexible manner to assign oauthlib.common.Request's user attribute before the access token is made and saved allowing to associate the device user with the access token user

Screenshot showing access tokens having users set from the device flow and verification_uri_complete(https://datatracker.ietf.org/doc/html/rfc8628#section-3.2) coming back from the authorization stage