collectForAccount() inconsistently removes refresh tokens when user is consumer default user

Attached patch fixes the inconsistent refresh token removal in collectForAccount().

The issue was that collectForAccount() excludes refresh tokens but then calls
collectForClient() which ignores this exclusion. This caused refresh tokens to
be removed when user is consumer default user.

Fix ensures consistent behavior regardless of consumer configuration.

Ready for review.

After implementing this change, you might need to modify the function responsible for invalidating all tokens. In such a scenario, it's crucial to remember to call collectForClient($client, TRUE).

Failing to do so could introduce a security vulnerability, as refresh tokens would remain active by default. When a user logs out, for instance, we typically want all associated tokens to be invalidated immediately to ensure complete session termination.

Thank you @dunjincan for reporting and providing a patch, I have updated the associated unit tests, because there were breaking due to this change.

Automatically closed - issue fixed for 2 weeks with no activity.