Implement OAuth refresh tokens

[byewokko]

closes #154

Breaking changes

• Some user sessions may be invalidated, which will log the user out.

Changes

• [x] Token endpoint /openidconnect/token now also
  • [x] returns refresh token alongside access token and id token,
  • [x] supports grant_type=refresh_token.
  • [x] supports basic client authentication (methods client_secret_basic and client_secret_post in addition to none).
• [x] Client API now supports token endpoint auth methods client_secret_basic and client_secret_post. It is possible to reset the client secret using the POST /client/{client_id}/reset_secret endpoint. Caution: This is API-only! The web UI does not display client secret yet.
• [x] OAuth session expiration is equal to the expiration of its refresh token.
• [x] Session tokens moved to a new token collection st and are no longer part of the session object. Only their hashes are stored - this is more secure.
  • [x] Access tokens
  • [x] Refresh tokens
  • [x] Authorization codes
  • [ ] Client cookies - These will be trickier, let's handle them in a separate merge request.
  • [ ] SSO (root) cookies - These will be trickier, let's handle them in a separate merge request.
• [x] Exceptions from seacatauth.client.exceptions moved to seacatauth.exceptions.
• [x] Functions set_cookie and delete_cookie from seacatauth.cookie.utils refactored to methods of seacatauth.cookie.CookieService.

Config

New config options and their default values:

[openidconnect]
authorization_code_expiration=3m
access_token_expiration=4h
refresh_token_expiration=3d
authorization_code_length=36
access_token_length=36
refresh_token_length=36

Limitations

• Refresh tokens are not supported for algorithmic session at the moment.