Authenticate confidential clients on refresh_token grant

Editor assessment

This commit patches CVE-2026-53512. The subject says confidential clients are now authenticated on the refresh_token grant, which is a precise statement of the security fix and names the affected flow. However, the header uses two scopes, `oidc-provider` and `mcp`, which the Conventional Commits content rules do not allow; that alone limits the score. There is no body, so the vulnerability, presumably unauthenticated refresh for confidential clients, and the reasoning behind the change are never spelled out. The PR number is appended in the usual way. Accurate and readable in substance, but the multi-scope header and missing rationale keep it at acceptable rather than exemplary.