Finish auth router

- [x] Figure out the `audience` properly (especially in init of the authorization code flow) (https://github.com/DIRACGrid/diracx/pull/219)
- [x] Encrypt the state (https://github.com/DIRACGrid/diracx/pull/215)
- [x] Hash some fields in the db: auth code flow and device code (https://github.com/DIRACGrid/diracx/pull/215)
- [x] Use asymeteric crypto for JWT we mint
- [x] validate poperties against subject (in `exchange_token`) (https://github.com/DIRACGrid/diracx/pull/212 & https://github.com/DIRACGrid/diracx/pull/219)
- [x] document the flows used (https://github.com/DIRACGrid/diracx/pull/219)
- [x] add tests against IAM (https://github.com/DIRACGrid/diracx/pull/113)
- [x] add tests for internal validation (tokens, scopes, etc, expiry, signing) (https://github.com/DIRACGrid/diracx/pull/219)
- [x] One ClientID per VO ? (i.e. one swagger for all) or one clientID for all (i.e. one swagger per vo)
- [x] One client per group ? vo in the scope instead of URL ?
- [ ] What happens if a user is suspended in IAM ( does that exists?)
- [x] Disable refresh token rotation for proxy obtained via `legacy_exchange` route (https://github.com/DIRACGrid/diracx/pull/187)