oauth2server: fix token expiration and refresh

* Sets access tokens to expire after a given time interval.

* Ensures only confidential clients can refresh an expired access token.

* Adds tests for token expiry to ensure correct behavior. (closes #2112)

Co-authored-by: Lars Holm Nielsen <lars.holm.nielsen@cern.ch>
Signed-off-by: Jiri Kuncar <jiri.kuncar@cern.ch>
previewer: fix folders identifiers in zip archive

Reported-by: Konstantinos Kostis <konstantinos.kostis@cern.ch>
Signed-off-by: Jiri Kuncar <jiri.kuncar@cern.ch>
base: fix dangerous demosite populate

* NOTE `inveniomanage demosite populate` asks for user confirmation or
  `--yes-i-know` argument.  (closes #2294)

Signed-off-by: Jiri Kuncar <jiri.kuncar@cern.ch>
workflows: fix bootstrap-tagsinput bundling

* Removes the global bundling of bootstrap-tagsinput which
  is used for the filter search in Holding Pen. (closes #2423)

Reported-by: Javier Martin Montull <javier.martin.montull@cern.ch>
Signed-off-by: Jan Aage Lavik <jan.age.lavik@cern.ch>
celery: deprecated celeryd replacement

* As of the celery version 3.1, `celeryd` is deprecated in favour of
  `celery worker`. It will be completely removed with the 3.2 version.

Signed-off-by: Daniel Lovasko <daniel.lovasko@cern.ch>
legacy: fix import in bibstat cli

* Fixes import in bibstat script.  (closes #2293)

Signed-off-by: Jiri Kuncar <jiri.kuncar@cern.ch>