fix: prevent redefinition of claims within tokenset

[fredericoo]

Fixes a problem in which if values contained the property claims, it would replace the claims function.

Discovered when trying to call claims() on next-auth via this line.

Checklist

✅ I've added tests to replicate the behaviour automatically

[panva]

Since there is no defined claims response parameter on the token, or authorization endpoints I don't agree with this PR's fix.

The solution needs to be ignore all unrecognized properties or throw them all in a single bag of "unrecognized", or something to that effect.

I'll ponder some more on this.