fix(core): isolate token cache by app secret

[Zhang-986]

Summary

• Include an app secret fingerprint in app and tenant access token cache keys.
• Prevent clients with the same app ID but different app secrets from reusing cached tokens.
• Keep raw app secrets out of cache keys by hashing them with SHA-256.

Fixes #126

Test Plan

• go test ./core -run 'Test(TenantAccessTokenCacheKeysIncludeCredentialMode|GetAppAccessTokenDoesNotReuseCacheAcrossAppSecrets|GetTenantAccessTokenDoesNotReuseCacheAcrossAppSecrets)' -count=1\n- go test ./core -count=1\n- go test ./... -count=1\n- go test -race ./core -count=1\n- go vet ./core\n- git diff --check