Client can define enforce_state and lifetime parameters

Client should be able to override enforce_state parameter and define custom lifetime for tokens (auth codes, access tokens and refresh tokens).

This PR add this functionnality and tests.

**It changes the client interface, so that this PR breaks compatibility and requires to bump version number.**