Returns a single Client from within the AuthGroup

This will bypass the normally protected GET /reg/{id} as long as the caller has the correct permissions. This is a convenience API and not the same as the OIDC call on the /reg endpoint which may require a registration access token. This API will sanitize the response.