oauth2server: fix token expiration and refresh

* Sets access tokens to expire after a given time interval.

* Ensures only confidential clients can refresh an expired access token.

* Adds tests for token expiry to ensure correct behavior. (closes #2112)

Co-authored-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
Signed-off-by: Jiri Kuncar <jiri.kuncar@cern.ch>
@lnielsen-cern it returns directly 401.