Allow overriding IsGenerateRefresh per request and per client

[ivucica]

• A particular client might be allowed to request only an access_token.
• Similarly, a client might temporarily opt out of requesting an access_token.

A use case is a client that's merely logging in a user and is happy to have the session last as long as an access_token, without a persistent refresh_token.

Right now, as far as I understand, it's "all authorization code swaps get a refresh token or none of them do". If I am mistaken, feel free to close this issue.