JWT authentication fails with invalid_client_id after the 5.1.3-beta2 OAuth refactor

Problem/Motivation

JWT (OAuth 2.0 JWT Bearer) authentication regresses in 5.1.3-beta2. After updating drupal/salesforce from a recent 5.1.x-dev build to 5.1.3-beta2, JWT auth providers can no longer obtain an access token: Salesforce returns 400 Bad Request {"error":"invalid_client_id"} from the token endpoint — even though the Connected App, Consumer Key, X.509 certificate, and run-as user are unchanged and verified correct. The identical configuration authenticates successfully on the prior version.

5.1.3-beta2 adds commit a97075fa ("OAuth refactor"), a large rewrite of the auth/token subsystem — including a ~408-line rewrite of modules/salesforce_jwt/src/Plugin/SalesforceAuthProvider/SalesforceJWTPlugin.php. The regression originates with that refactor: the last 5.1.x-dev commit preceding it authenticates fine; 5.1.3-beta2 does not.

Steps to reproduce

1. A site using salesforce_jwt with a working JWT auth provider
   (Consumer Key, run-as user, certificate uploaded to the Connected App's
   "Use digital signatures").
2. Confirm JWT auth works on 5.1.x-dev at the commit immediately
   before a97075fa.
3. composer require drupal/salesforce:5.1.3-beta2, then
   drush cr.
4. Trigger any Salesforce API call (or the auth provider's connection check).
5. Observed: the token request fails —
   POST https://<instance>/services/oauth2/token →
   400 {"error":"invalid_client_id"}; Drupal logs an
   OAuth\Common\Storage\Exception\TokenNotFoundException from
   SalesforceAuthTokenStorage::retrieveAccessToken().
6. Reverting drupal/salesforce to the pre-a97075fa
   commit restores JWT authentication with the identical configuration.

Environment: Drupal core 10.6.x, PHP 8.3, salesforce 5.1.3-beta2,
salesforce_jwt enabled. Every environment running 5.1.3-beta2 is
affected; environments still on the prior version are not.

Proposed resolution

Identify and fix the defect introduced by the a97075fa OAuth
refactor that causes the JWT bearer token request to be rejected with
invalid_client_id — most likely in how the rewritten
SalesforceJWTPlugin builds the token request or passes the
client_id (Consumer Key). Restore the pre-regression JWT behaviour.

Remaining tasks

• Bisect the three commits in 5.1.3-beta2 to confirm a97075fa
  is the cause and isolate the specific change.
• Patch SalesforceJWTPlugin (and related auth/token classes if
  needed).
• Add automated test coverage for JWT token acquisition.
• Tag a fixed release (5.1.3-beta3).

User interface changes

None.

API changes

None proposed — this is a regression fix; it should restore the pre-refactor JWT behaviour without a further API change.

Data model changes

None.