Invalidate a token by authenticating using the same token

This is something that I ran into several times.

We have the [`DELETE /applications/{client_id}/token`](https://docs.github.com/en/rest/reference/apps#delete-an-app-token) endpoint which permits to delete a token today. But it requires the OAuth's `client_id` and `client_secret` for authentication. I don't think that should be necessary. It's a security concern that I cannot create an OAuth token, use it for a task, and then remove it, unless the owner of the OAuth provides a backend architecture which allows to invalidate my token without exposing the `client_secret`

Start with the documented DELETE /applications/{client_id}/token endpoint linked in the issue and review its current authentication requirements. Compare those requirements with the proposed same-token authentication flow. Done would mean a decided, documented API change that permits token invalidation without exposing the OAuth client secret.

Written by the indexing model from the issue text.