Pass OAuth credentials per operation (breaking API change) - #22

ShopifyOAuthClient currently requires client ID and secret constructor arguments even for operations that do not use both. Application-only token requests need no client secret, HMAC validation needs no client ID, and authorization URL construction needs no secret. Callers therefore have to supply irrelevant values or construct a partially configured client.

This change makes credential requirements explicit at each operation and leaves the instance responsible only for HTTP transport. One instance can serve multiple apps or rotated credentials without retaining app credentials in fields.

Public API changes

• Replace the credentials constructor with ShopifyOAuthClient(HttpClient httpClient = null).
• Make BuildAuthorizationUrl static and add clientId as its first parameter.
• Make IsValidHmac static and add clientSecret after queryParameters.
• Add clientId and clientSecret before the existing parameters on migration, refresh, ID-token exchange (online/offline), and authorization-code exchange (online/offline) methods.
• Add only clientId before the existing parameters on RequestClientAssertionAccessTokenAsync.
• Keep IsValidShopDomain, response models, and exception types unchanged.

These replace the existing signatures without compatibility overloads and are source/binary breaking changes. README examples include migration guidance; the type generator, test credential helper, and all repository callers are updated. Missing credentials are checked at the operation that requires them, before sending HTTP requests.

Validation

• Added parameterized tests covering per-call credentials for all six secret-based flows using one client for two apps.
• Extended assertion tests to verify the per-call client ID in both the form and JWT issuer/subject.
• Added missing-credential tests and updated existing helper, signing, and integration tests.
• git diff --check passed; searched repository callers for old signatures.
• Build/tests were not run locally because the .NET SDK is unavailable. The PR workflow runs build and tests.

The HTTP/2 transport configuration is handled separately in #21.