Request authentication now gets the token's client from the simple_oauth.repositories.client service. The OAuth flows already use this service. If you decorate the client repository, your decorator now also controls the client used for requests made with a token.
TokenAuthUser::getClient() returns the client as a Drupal\simple_oauth\Entities\ClientEntityInterface. TokenAuthUser::getConsumer() is deprecated in simple_oauth 6.1.5 and is removed from simple_oauth:7.0.0.
Before:
$consumer = $account->getConsumer();
After:
$consumer = $account->getClient()->getDrupalEntity();
TokenAuthUser::__construct() takes an optional fifth argument, ?ClientEntityInterface $client. Leaving it out is deprecated in simple_oauth:6.1.5 and it will be required in simple_oauth:7.0.0. Code that builds TokenAuthUser directly should pass the client from the client repository.
The X-Consumer-ID request header now holds the client's identifier.
A token for an unpublished consumer now fails with invalid_client, not access_denied. The response is still a 401.
