Refresh OAuth2 tokens automatically

[eisenmann-b1]

This adds token refreshing functionality.

List of changes:

• Tokens are saved as user attrs in the cache.
• Add flag --refresh-access-token to oidc_child:
  If set, a refresh token is read from standard input, that is then used to acquire a new set of tokens (access, id, refresh) via refresh_token grant type.
• Add option idp_auto_refresh:
  If set to true (default false), tokens are automatically refreshed, after reaching half their lifetime.

[gemini-code-assist]

Code Review

This pull request introduces OAuth2 token refreshing, both manually via a new oidc_child command and automatically through a new configuration option. The changes span configuration, database schema, the oidc_child tool, and the idp provider. While the overall implementation is solid, I've identified several issues, including copy-paste errors in logging that could be misleading, a critical bug in parsing input that may cause token refresh to fail, and a minor bug where a function's return value is not checked.

[gemini-code-assist]

There's a bug here when reading the refresh token from stdin if a client secret is also provided. The str variable points to the client secret at this point, so strchr(str, '\n') will always be NULL. This means a newline at the end of the refresh token will not be stripped, which can break the subsequent POST request. You should search for the newline in *token instead.

    sep = strchr(*token, '\n');
    if (sep != NULL) {
        *sep = '\0';
    }