fix(oauth): bind token exchanges to the original client request (#37704)

[lunny]

Backport #37704

This PR hardens OAuth token exchange validation by binding exchanged credentials to the client and redirect URI that originally obtained them.

What it changes:

• reject refresh token exchanges when the refresh token belongs to a different OAuth application
• reject authorization code exchanges when the redirect_uri in the token request differs from the redirect_uri stored with the authorization code
• add integration coverage for:
  • authorization code exchange with a mismatched redirect URI
  • refresh token reuse across two different dynamically created OAuth applications

Why:

OAuth authorization codes and refresh tokens must remain bound to the client context that originally received them. Without those checks:

• a valid authorization code can be redeemed against a different registered redirect URI of the same client
• a refresh token can be replayed by a different OAuth client

[bircni]

@lunny checks fail