Invalidate a token by authenticating using the same token

This is something that I ran into several times.

We have the [`DELETE /applications/{client_id}/token`](https://docs.github.com/en/rest/reference/apps#delete-an-app-token) endpoint which permits to delete a token today. But it requires the OAuth's `client_id` and `client_secret` for authentication. I don't think that should be necessary. It's a security concern that I cannot create an OAuth token, use it for a task, and then remove it, unless the owner of the OAuth provides a backend architecture which allows to invalidate my token without exposing the `client_secret`