prevent LTI logout service token reuse

test plan:
 0. configure an external tool that uses $Canvas.logoutService.url
 1. use that URL to register a logout callback (using OAuth 1.0
    signing with the tool's consumer key and shared secret, and
    adding a callback parameter set to the URL to hit). you should
    get a status 200 response if the auth is correct.
 2. repeat step 1. this time you should get status 401 with a
    message saying the logout service token has already been used.
 3. log out and confirm that the callback registered in step 1
    is hit.

fixes CNVS-16009

Change-Id: Ic4aaa8fe928b791a63a9cce61648dc48aeba4f9d
Reviewed-on: https://gerrit.instructure.com/42187
Reviewed-by: Brad Humphrey <brad@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>