[cfid-658] Remove user_id, user_name and email from client tokens

Exclude user-specific attributes from refresh and access tokens for client_credentials
grant.