Support client authentication for authorization-code grant type

When using a confidential client it should be possible to obtain
a token through authorization code grant type with a valid code.

This makes `OAuth2RequestValidator.validate_code()` and
`OAuth2RequestValidator.confirm_redirect_uri)` support retrieving
client from either request.client or request.client_id.