fix(oauth2): stop closing result channels and blocking on sends

What does this MR do and why?

Two robustness fixes to CallbackServer.GetToken and its callback handler.

• Stop closing the result channels. GetToken used defer close(...) on tokenChan and errorChan, but a callback handler can still be running after GetToken returns (for example, an exchange that outlives the 5s shutdown timeout). Its send then panics with "send on closed channel". net/http recovers that panic, but the request is dropped and the panic is logged. The channels are now left for the garbage collector.
• Send results without blocking. Both channels have a buffer of 1, so a second result (for example, two failed callbacks) blocked its handler goroutine forever. Sends now go through a small non-blocking helper, sendResult, so only the first result is kept and later handlers still return.

An earlier revision also preferred a pending token over a duplicate callback's error. Following the review discussion, that change was dropped because invalid_grant is the correct outcome in that case.

Related to #2295 (closed)