Cognito client secrets - API client

### Dependency

- #324

### Overview

As discussed in #147, we need to implement app tokens in addition to user cognito tokens so we can restrict access to approved apps only. i.e. VRMS, website, CTJ.

- #147

### Action Items

- [ ] ~~research ways to add app tokens in django and DRF~~
- [ ] ~~compare a few if there's many and write a decision record (DR) on why we should choose one~~
- [ ] ~~create a work issue to implement the app token~~
- [ ] if #324 doesn't use `client secret`, update #242 to point to #323
- [ ] close this issue as done since there's a work issue for it and #328 also creates API clients with `client secret` enabled.

### Resources/Instructions
- https://djangopackages.org and search for token
- [Cognito's app client with client secret](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-client-apps.html) is an option