Update ONC refresh token test to require new refresh token be issued.

[arscan]

A requirement of ONC certification is that systems under test issue new refresh tokens when access tokens are refreshed. This PR updates the ONC refresh token test to have an additional check to make sure that they don't match.

This requirement is technically only for apps that 'can protect a client secret', which is interpreted here as 'confidential clients', so the test is omitted if it is for a public client.

Submitter:

• This pull request describes why these changes were made
• Internal ticket for this PR:
• Internal ticket links to this PR
• Internal ticket is properly labeled (Community/Program)
• Internal ticket has a justification for its Community/Program label
• Code diff has been reviewed for extraneous/missing code
• Tests are included and test edge cases
• Tests/code quality metrics have been run locally and pass

Reviewer 1:

Name:

• Code is maintainable and reusable, reuses existing code and infrastructure
  where appropriate, and accomplishes the task's purpose
• The tests appropriately test the new code, including edge cases
• You have tried to break the code

Reviewer 2:

Name:

• Code is maintainable and reusable, reuses existing code and infrastructure
  where appropriate, and accomplishes the task's purpose
• The tests appropriately test the new code, including edge cases
• You have tried to break the code