Don't require logout/login to change a user's permissions on pdm

[vorpal-buildbot]

Reported on Discord by bakert#2193

[bakert]

We possibly want to store the refresh token and re-check with Discord's OAuth if session is older than N hours (minutes?) old.

https://discord.com/developers/docs/topics/oauth2

[bakert]

I have set up a rather hacky way to revoke admin or demimod privileges (or set them!)

You make an entry in decksite's permission_changes table with NULL, 'admin' or 'demimod' alongside the discord id you want to revoke or grant privileges to.

Because folks might be logged in in multiple locations we're just doing this check on every page load forever which sucks pretty bad.

The right fix here is something like:

• When someone visits the site and have all our current session cookie stuff, store all that in the db (encrypted), remove it all, and set a single (new) identifier that references the entry in the db. (DON'T log everyone out of the site just to move to a new system.)
• When someone authenticates with Discord set the new database/single id in session stuff up instead of the old stuff.
• Create an admin tool that allows admins to set it so that we re-lookup someone's privs instead of trusting what we have stored. (For when we remove a priv, or even for when we add one, in Discord.)
• After some reasonable period of time stop respecting the old way of doing things and instead just use the new system. If you have the old cookies just ignore them and make you authenticate with Discord. Remove the old code.

This is a bit more complicated than it sounds (and it sounds a little complicated) because the auth stuff is very shared_web and not very decksite. It needs to mostly be migrated to decksite if it's going to use a table in decksite's db to track all this. And we do just reach into the session cookie and do things in quite a few places including when logging any github ticket (but we do check flask.request is not None first to avoid runtime errors). So we'd need to work out a sensible way for those parts of the code to ask for auth info. Or maybe just exempt them from going through wrapper code and let them look in the session. Anyway, you get the idea, it's not totally straightforward. But it would be good to get this ship shape.