Support revoke function

[judgej]

Xero has an endpoint, with basic authorisation, that takes a renewal token and will revoke all granted scopes and connected tenants for the token. This is the only way to revoke all grants at this time (even disconnecting all the tenants leaves the scopes intact, and they all appear when you reconnect tenants).

I was about to write a Xero provider, then found this, so happy to add that function this weekend if you would like to include it. I'll add this provider to the League page too, since there is a gap waiting for it there.

[calcinai]

@judgej That'd be wonderful, thanks!

[judgej]

PR #7 created.

[judgej]

The additional properties on the resource owner allow me to strip out some JWT parsing from my fork of the https://github.com/XeroAPI/xero-php-oauth2-app app that introduces the revoke function. That may or may not be accepted as a PR, but it's all code I need to be sure works for me anyway. Just tring to get rid of the noise in the demo app so we can see the OAuth flow implemented with maximum features and minimum effort.

Also learning much that is not clearly documented:

The different bewteen xero id and subscriber (sub), is still a mystery to solve. The sub is probably not important, but I'm keeping an eye on it on a hunch.

The iat seems to be the last auth flow time, when the ID token was issued. I'm assuming that doesn't get refreshed with the access token refresh? Correct me if I'm wrong there. The ID token does expire in half an hour, along with the access token, so are we supposed to request a new ID token with the access token refresh? Maybe we do get one and I haven't noticed. The user's details could change in that time - email, given/family names, and it may be important to know that for some offline apps that use those details to send notifications to the Xero user, for example.

The auth_time looks like the time the authorisation was first performed for the app with that resource owner (i.e. xero user). I believe that won't change until the token is revoked and authorisation is starting from scratch, but I need to confirm that. All these additional properties are useful for an audit trail when things go wrong.