OAuth apps can opt in to token expiration and refresh [Public Preview]

### Value Prop
OAuth apps can now perform token rotation using short-lived access tokens and refresh tokens, giving developers a straightforward way to meet security standards and eliminating a source of long-lived tokens. This feature is opt-in for existing OAuth apps and on by default for newly created ones, so app developers can test and roll it out safely.

### Expected Outcome
Rotating OAuth tokens regularly limits the window of exposure if a token is ever compromised — any previously exfiltrated token becomes invalid upon rotation. They also expire after 8 hours, the same as GitHub App user tokens. Developers building OAuth apps will be able to satisfy security policies that require credential rotation.

这是 GitHub 公共路线图中的功能提案，没有指定任何仓库文件、测试或实现入口。首先查看 issue 中关于 OAuth app token 轮换的要求；完成标准是现有 app 可以选择加入，新 app 默认启用该功能，access token 在 8 小时后过期，并且 refresh token 轮换会使之前的 token 失效。

由索引模型根据 Issue 内容生成。