feat(keycardai-langchain): forward client_id on the as-itself grant

[devin-ai-integration]

Summary

• For ECO-306, _client_auth_fields forwards a prepared client_id with jwt-bearer assertion fields into the as-itself client-credentials call.
• Raises the keycardai-oauth dependency floor to 0.24.0, the release that accepts client_id on that grant.
• Covers assertion credentials both with and without a prepared client_id.

Open questions: None.

Link to Devin session: https://app.devin.ai/sessions/fb88d151f4014439a2b12a9a90312d5b
Requested by: @Larry-Osakwe

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[Larry-Osakwe]

Both directions of the forwarding are pinned (client_id present in the grant kwargs when the credential prepares one, key absent when it does not), the lift stays inside the assertion branch, and the floor bump guarantees the parameter exists downstream. Nothing to change.