gracefully handle oauth cert rotation

once #842 is merged in, certs will be getting created and automatically rotated 15 days before they expire.

This means that if 1 day before the certificate is renewed, it's used to issue a token, in 2 days, that certificate will be renewed, the token should still be valid, however because the certificate that signed the token has been replaced lexbox won't be able to validate the token anymore, forcing the user to authorize the application again.

What we should have is 2 certificates with offset expiration periods, if you give openiddic 2 certificates it will sign with the cert that expires last, however it will still validate tokens with older certs. This means that we should never sign a token with a cert that will expire before the token does.

Example:

• cert A: expires in 20 days
• cert B: expires in 50 days

an application has a refresh token signed by cert A, and wants to get a new refresh token. It issues the request, the old token is validated against cert A, and a new refresh token is issued that is signed by cert B. This new refresh token is set to expire in 30 days.

30 days pass
certs:

• cert A: expired and deleted, the server no longer has access to this cert
• cert B: expires in 20 days
• cert C: expires in 50 days, this cert was created since

the applications new refresh token has not yet expired, and they want to renew it. This token was signed with cert B which the server still has, the server can validate the token and issue a new token signed by cert C.

Review issue #842 and the OpenIddict certificate-rotation configuration first; the payload names no source files or tests. Trace how signing and validation certificates are selected during rotation, then verify that unexpired refresh tokens remain valid and new tokens use a certificate whose lifetime covers the token.