M2M service clients

OAuth client_credentials clients for backend services. Copy generated secrets into caller config or Key Vault — they cannot be viewed again.