need expiration for device authn access tokens

[davepacheco]

Today, device authn access tokens do not expire. They presumably should.
(creating this for these TODO-security comments:

omicron/nexus/src/app/device_auth.rs

Line 121 in b062e95

// TODO-security: set an expiration time for the valid token.

omicron/common/src/sql/dbinit.sql

Line 1773 in b062e95

-- TODO-security: expire tokens.

)

(edit: these comments were removed under #2417 but the issue remains)