Unify client_id/client_secret errors to prevent information disclosure