Fix cache key hash collision: length-prefix extended cache key components (#946)

* Fix cache key hash collision: length-prefix extended cache key components

The extended cache key serialization concatenated sorted key+value pairs
with no delimiters, which is not injective: distinct component sets such as
{fmi_path: 'value'} and {fmi_pat: 'hvalue'} serialized to the same string
and hashed to the same cache key, causing cache-slot collisions and
redundant token re-fetches.

Adopt MSAL Go's length-prefixed (netstring) encoding
(<byteLen(key)>:<key><byteLen(value)>:<value> per sorted key, UTF-8 byte
lengths), which is injective and byte-identical across the MSAL SDK family.

* Address review: harden injectivity fuzz test

Skip same-key pair combinations explicitly (a dict comprehension would
silently overwrite and collapse intended 2-entry cases), and assert on
len(seen) -- the count of distinct component sets exercised -- instead of
a raw iteration counter.

* Address review: clarify injectivity wording in docstrings

Reword the token_cache and test docstrings to state that the length-prefix
scheme makes the *serialization* injective (distinct inputs cannot produce
the same pre-hash string), rather than implying absolute impossibility of a
collision at the SHA-256 hash layer. Also quote the dict-literal examples as
valid Python.