[Client] Key stored OAuth tokens by client, not only by issuer and resource #719

CredentialStorageInterface keys tokens by issuer and resource only, so two OAuth configurations sharing one storage pick up each other's tokens - a service account with setScopes('mcp:read') and a user-facing app with broader scopes, or two clients with different client IDs at the same authorization server.

#669 keeps a service account from reusing a stored token beyond its configured scopes, but that only covers the scope side. A token issued to another client, or a refresh token that only another client can spend, is still taken over as it is.

Options I see:

a) add the client ID to getToken() / saveToken()
b) compose the key in OAuthAuthenticator from client ID and grant, and keep the interface as it is
c) store the client ID on AccessToken and refuse a token of another client on read

The interface is new in 0.10.0, so changing it before that release is no BC break. I'd go with a) - WDYT?