retain pre-computed customizationCss for untrusted PDS clients #14

The CSS generation has been moved from pre-computation (line 17 in the factory function) to per-request computation inside the handler function. This creates a performance regression because buildCustomizationCss will be called for every authorization request instead of once when the factory is initialized.

For authorization pages that don't use client branding (non-trusted clients or clients without branding), this adds unnecessary overhead on every request. Consider maintaining the pre-computed customizationCss for the base case and only computing client-specific CSS when needed.

Originally posted by @Copilot in #9 (comment)