[client] Pass the login hint to GetOAuthFlow at construction

GetOAuthFlow was the only flow factory without a hint parameter, which
forced its callers to apply the hint afterwards through a local setter
interface and a type assertion. Give it the same constructor-style hint
as NewOAuthFlow and set the hint on the concrete flows before they are
handed out as the interface, so a flow is always complete when built
and the caller-side ordering constraint disappears.

An empty hint is a valid value meaning the IdP chooses the account, so
the flows set it unconditionally.

client/android/ssh_client.go

@@ -476,14 +476,14 @@ func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config, cfgPath string)
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
-	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, "")
+	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath))
 	if err != nil {
 		return "", fmt.Errorf("create oauth flow: %w", err)
 	}
 
 	// The status callback covers the browser round-trip, which would
 	// otherwise leave the terminal blank.
-	tokenInfo, err := runOAuthFlow(ctx, flow, profileLoginHint(cfgPath), urlOpener, func() {
+	tokenInfo, err := runOAuthFlow(ctx, flow, urlOpener, func() {
 		s.notifyStatus("Waiting for browser authentication...")
 	})
 	if err != nil {