OAuth2 Provider: Add maximum session lifetime (absolute expiry) setting

### Is your feature request related to a problem?

The OAuth2 provider has no way to enforce an absolute session lifetime. Because refresh token rotation issues a new refresh token with a fresh validity period, an active user's session can be extended indefinitely.

There is no setting on the OAuth2 provider to say "regardless of refresh token rotation, this user must re-authenticate after X hours."

### Describe the solution you'd like

A maximum session lifetime setting on the OAuth2 provider, specified in the same hours=X,days=Y format as other duration fields.

### Describe alternatives that you've considered

- Setting Refresh Token threshold to seconds=1. This minimizes the window in which rotation can happen, but doesn't eliminate it. If a refresh request happens to land in that 1-second window, a new refresh token is still issued with a full validity period, making the session indefinitely extendable. It's probabilistic, not deterministic.

- Enforcing the limit application-side: defeats the purpose of centralizing auth in Authentik.

### Additional context

I am not sure whether this beats the whole purpose of refresh tokens and I would like to hear your feedback! If some things are unclear, I'll be happy to explain further.

Start by tracing the OAuth2 provider's refresh-token rotation path and the existing duration settings that use hours=X,days=Y. Determine how an absolute maximum session lifetime should interact with refresh-token issuance, then add coverage showing that refreshes cannot extend the session beyond the configured lifetime and that re-authentication is required.

Written by the indexing model from the issue text.