oauth: let the authorize tests say what they are testing

Every test hand-built the same five request parameters, burying the one
parameter it was actually about, and ten pairs of them sent the same
request twice, to assert the response in one and the logged reason in the
other. One helper now builds the request, and each pair is a single test
asserting both halves -- two tables for the rejected requests, which
exposed the one rejection reason no test covered: a repeated scope
parameter.

Two POST tests also ran without a login session, where check_csrf_token()
returns early, so the deny path had no CSRF coverage at all. The clients
the tests register are cleaned up now, instead of outliving the file.

JIRA-Ref: CMK-38012
Change-Id: I3b8cfe77150618186b0bc252374127e0373dd20a