oauth2server: fix token expiration and refresh

• Sets access tokens to expire after a given time interval.

• Ensures only confidential clients can refresh an expired access token.

• Adds tests for token expiry to ensure correct behavior. (closes #2112)

Co-authored-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
Signed-off-by: Jiri Kuncar <jiri.kuncar@cern.ch>