Feat/seedless refresh token

[tuna1207]

Explanation

Add refresh token and revoke refresh token handling to SeedlessOnboardingController

• persist refresh token in state
• store revoke token in vault
• check for token expired in toprf call, refresh token and retry
• revoke refresh token and replace with new one after password submit to prevent malicious use if refresh token leak in persisted state

References

Changelog

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

[lwin-kyaw]

I don't think we should store the refreshToken in plain text

[lwin-kyaw]

Can this go inside the vault? We can decrypt and get it whenever we want.

[tuna1207]

@lwin-kyaw after discussing with @himanshuchawla009 we decided to go with this refresh token + revoke token approach since the checkIsPasswordOutdated call need to be checked when app is locked (vault is locked) so we need refreshToken outside vault
revokeToken is inside the vault and will be used to revoke refreshToken for new one (invalidate the old one) after user unlock the app

[lwin-kyaw]

Can this go inside the vault, too?

[tuna1207]

@lwin-kyaw this is only temporarily stored in state (not persisted) for subsequent call to store in vault createToprfKeyAndBackupSeedPhrase, fetchAllSeedPhrases after authenticate
it's also cleared from temp state when app locked