Enforce client binding on refresh token grant

Implements RFC 6749 compliance for refresh token grants to prevent token reuse across different clients.