OAuth apps can opt in to token expiration and refresh [Public Preview]

### Value Prop
OAuth apps can now perform token rotation using short-lived access tokens and refresh tokens, giving developers a straightforward way to meet security standards and eliminating a source of long-lived tokens. This feature is opt-in for existing OAuth apps and on by default for newly created ones, so app developers can test and roll it out safely.

### Expected Outcome
Rotating OAuth tokens regularly limits the window of exposure if a token is ever compromised — any previously exfiltrated token becomes invalid upon rotation. They also expire after 8 hours, the same as GitHub App user tokens. Developers building OAuth apps will be able to satisfy security policies that require credential rotation.

This is a GitHub public-roadmap feature proposal and names no repository files, tests, or implementation entry point. Start by reviewing the OAuth app token-rotation requirements in the issue; done means existing apps can opt in, new apps default to it, access tokens expire after 8 hours, and refresh-token rotation invalidates prior tokens.

Written by the indexing model from the issue text.