Clarify why client_claims and claims are both redacted in add() log

The test comment implied both fields live in event[data] to feed ext_cache_key, but claims is in _EXT_CACHE_KEY_EXCLUDED_FIELDS and does not affect the hash. Reword to distinguish the cache-key-only client_claims pseudo-param from the real OAuth claims wire parameter; both are redacted for log-safety regardless. Test comment only.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Robbie-Microsoft

tests/test_token_cache.py

@@ -59,9 +59,12 @@ def setUp(self):
             TokenCache.CredentialType.ACCESS_TOKEN]
 
     def test_add_redacts_client_claims_in_debug_log(self):
-        # forwarded_client_claims (and the merged "claims") are kept in
-        # event["data"] only so they contribute to ext_cache_key. They may carry
-        # sensitive values, so TokenCache.add()'s DEBUG log must redact them.
+        # Both fields live in event["data"] for different reasons: the
+        # cache-key-only "client_claims" pseudo-param contributes to
+        # ext_cache_key (it is excluded from the wire), while the merged "claims"
+        # is a real OAuth wire parameter that is excluded from ext_cache_key. Both
+        # may carry sensitive values, so TokenCache.add()'s DEBUG log must redact
+        # them regardless of whether they affect the hash.
         secret = '{"access_token": {"nbf": {"essential": "SENSITIVE"}}}'
         with self.assertLogs("msal.token_cache", level="DEBUG") as cm:
             self.cache.add({