Refresh tokens are saved without a client reference

Problem/Motivation

RefreshTokenEntityNormalizer::normalize() returns only value and expire. Access tokens and auth codes go through TokenEntityNormalizer, which also sets client. Refresh tokens don't, so every refresh_token row has an empty client field.

As a result, nothing can find refresh tokens by client:

• ExpiredCollector::collectForClient($client, TRUE) never returns refresh tokens, even though $include_refresh exists for exactly that.
• Deleting a consumer, or any cleanup keyed on the client, leaves its refresh tokens behind.

Steps to reproduce

1. Complete an authorization code flow for a consumer with the refresh_token grant.
2. Load the new oauth2_token entity with bundle refresh_token.
3. $token->get('client')->isEmpty() is TRUE.
4. \Drupal::service('simple_oauth.expired_collector')->collectForClient($consumer, TRUE) returns only the access token.

Proposed resolution

Set client in RefreshTokenEntityNormalizer::normalize() from the access token the refresh token belongs to:

$client = $token_entity->getAccessToken()->getClient();
assert($client instanceof ClientEntityInterface);
return [
  'client' => ['target_id' => $client->getDrupalEntity()->id()],
  'value' => $token_entity->getIdentifier(),
  'expire' => $token_entity->getExpiryDateTime()->format('U'),
];

Existing refresh tokens can't be backfilled, because the row has no link to its access token. They expire on their own (the default is 14 days).

Remaining tasks

• MR with a kernel test asserting collectForClient($client, TRUE) returns the refresh token.

Data model changes

None. The client field already exists on every bundle.

AI disclosure

AI-Generated: Yes. I drafted this issue summary with Claude Code and reviewed it before filing.