Bind GitHub OAuth codes to their client

• With OAuth apps configured, POST /login/oauth/access_token answers bad_verification_code when the code was issued to another client_id, and the code stays usable by the app it was issued to.
• Exchanges of an app's own code and the permissive mode without oauth_apps are unchanged, with regression tests in oauth-code-client.test.ts.

References:

• bad_verification_code for a code that is incorrect or does not match the authorization request: https://docs.github.com/en/apps/oauth-apps/maintaining-oauth-apps/troubleshooting-oauth-app-access-token-request-errors#bad-verification-code
• Codes issued per client_id in the web application flow: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#web-application-flow

Fixes #378