fix: include oidc-auth-request-extra-params in token cache key

[cnuss]

Summary

• Fixes token cache collision when using --oidc-auth-request-extra-params with different values
• Adds AuthRequestExtraParams field to tokencache.Key struct
• Extracts extra params from grant options via new AuthRequestExtraParams() method on GrantOptionSet

Problem

The token cache key computation did not include the AuthRequestExtraParams values from the --oidc-auth-request-extra-params flag. This caused tokens with different extra parameters (e.g., different audience values) to incorrectly share the same cache entry.

For example:

kubelogin get-token --oidc-auth-request-extra-params audience=api1
kubelogin get-token --oidc-auth-request-extra-params audience=api2

Both commands would use the same cache key, causing the second call to return the token from the first call, even though they requested tokens for different audiences.

Test plan

• Added tests verifying different AuthRequestExtraParams produce different cache checksums
• Added tests for GrantOptionSet.AuthRequestExtraParams() method
• All existing tests pass
• go vet passes

Fixes #1496

[cnuss]

@int128 Would appreciate your review when you have a chance. This fixes a cache collision issue when using --oidc-auth-request-extra-params with different values (e.g., different audience parameters).