Allow rotating client secret

[CarinaWolli]

Allow rotating the OAuth client secret. When a new secret is generated, the previous secret should be invalidated.

[linear]

CAL-7082

[crackedhandle]

“I’d like to work on this. Is anyone already working on it? Any design preference?”