Better handle access tokens

[balloob]

We don't store access tokens, they are lost every restart of Home Assistant.

I still don't want to store access tokens. They change too often.

Instead I suggest that we make the access tokens JWT tokens signed with the refresh token.

That way we can check validity without having to keep track of them.

[awarecan]

Do we ever need revoke/invalid one or all access_token?

[balloob]

We will add support for revoking refresh tokens.

[balloob]

Just to expand a bit more on my last comment: revoking a refresh token will revoke all access tokens it ever created.