[client] Match accounts only on the email claim of the ID token

The name-claim fallback in the ID token parsing is kept for the login
hint and display, but account matching now only considers a value that
came from the email claim, so a token without one no longer produces a
false account mismatch.

client/server/login_account_test.go

@@ -115,7 +115,7 @@ func newSSOTestServer(t *testing.T, hint string, accountPrompted bool, tokenEmai
 	t.Helper()
 	s := New(internal.CtxInitState(context.Background()), "console", "", false, false, false, false)
 	s.oauthAuthFlow = oauthAuthFlow{
-		flow:            &stubOAuthFlow{token: auth.TokenInfo{Email: tokenEmail}},
+		flow:            &stubOAuthFlow{token: auth.TokenInfo{Email: tokenEmail, EmailClaim: tokenEmail}},
 		info:            auth.AuthFlowInfo{UserCode: "code"},
 		expiresAt:       time.Now().Add(time.Minute),
 		hint:            hint,