Enhancement: support RFC 7009 for token revocation

RFC 7009 describes explicit revocation of OAuth2 tokens. For example, if a user running a session maintained by OAuth2 access & refresh tokens wishes to explicitly “log out” i.e. invalidate their current token set.

Of course, a consuming application could wire up their own logic directly to revoke tokens, but it occurred to me that it might be a nicety to support this as a function on the AuthorizationServer class.

[jasonraimondi]

I’m going to cut a release for this one when I get a moment

[oliverlockwood]

@jasonraimondi OK, I’ve implemented this now with coverage of both the auth_code and refresh_token grants - which are the only ones it makes sense for me to be revoked in this manner.

Please give the PR a review when you have the chance.