SSP-1387 Refuse new Tokens and delete existing for soft-deleted Clients

Also delete existing Tokens when a Client's username (clientId) changes.

These are deletions of *all* Tokens associated with the Client. This
is as opposed to a change to Client secret and/or permissions, which
just invalidates any Tokens associated with Client-only authentication
(which happens to be the only type we currently support).