Add OIDC offline sessions and refresh tokens
This MR fixes #813 (closed) by implementing OIDC Offline sessions https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
we also support refresh tokens for online sessions, allowing Access tokens to expire in a much shorter time than what we are doing now.
A new manager tab lets the admin see existing offline sessions and delete them manually if needed