Prevent public clients from using the client_credentials grant type

[matt-allan]

This PR updates the ClientCredentialsGrant to fail if the client is not confidential.

According to the OAuth specification the client credentials grant type should only be used with confidential clients.

The client MUST authenticate with the authorization server as described in Section 3.2.1.

https://tools.ietf.org/html/rfc6749#section-4.4.2

While it's possible to check this in the validateClient method it's possible the user failed to do so. As explained in #1034 the example repository is not checking this and the docs don't tell you to check this either so it's likely other developers have missed this.

By checking it in the ClientCredentialsGrant we don't need to require the user to implement the check themselves.

I had to update a few tests that were relying on this behavior.

[Sephster]

Thanks @matt-allan - looks good. I made some minor adjustments to formatting and added a note in the changelog but otherwise is good to go. Thanks for submitting this!