Token endpoint requirement for `client_id` parameter

[cicnavi]

Currently we require that client_id parameter is always present for requests on token endpoint. However, OAuth2 says:

client_id
REQUIRED, if the client is not authenticating with the
authorization server as described in Section 3.2.1.

This needs to be brought in line with the fact that, for example, we support private_key_jwt client authentication.