Refactoring OAuth2 service

[evert]

This became a bit bigger than expected, but:

• Refactors the OAuth2 service to have more consistent function signatures.
• Adds token statistics to the oauth2 homepage.
• Stores the 'grant_type' and whether a 'secret' was used in the tokens table.
• We're now storing 'scope' for every token. This OAuth2 feature wasn't really used by this server, but this sets up the first steps for this.
• Fixes a bug related to generating principal uris in the introspection endpoints.
• Has more explicit support for the 2 a12nserver-specific oauth2 flows: "developer tokens" and "one-time-tokens".
• Run sqlite migrations in github actions

Other side-effects of this PR:

• A few step furthers in #405
• Some progress towards OpenID Connect support (scopes are important for this).