implement refresh token support

[bacongobbler]

The Fermyon Cloud provides refresh token support to API clients.

By implementing refresh token support in the Spin CLI, we prevent the user from needing to run spin login as long as their refresh token is valid (6 months after date of issue). This also allows us to aggressively reduce the authentication token expiration date that Cloud issues to clients to prevent man-in-the-middle attacks.

In the event that the token and refresh token are stolen, we can revoke all refresh tokens for the user, forcing them to log back in.

As a side benefit: as long as you continue to use spin deploy once every 6 months, you should only need to perform the device code login mechanism once.

[itowlson]

LGTM - this will be so convenient!

[itowlson]

@bacongobbler Is this okay to merge? (I can resolve the Cargo.lock conflicts if you are heads down on other things.)

[bacongobbler]

Oh yeah! I couldn’t remember if the LGTM policy was 1 or 2. If you have the time today, please feel free to do so :)

[itowlson]

@bacongobbler My optimism was ill-founded - I ended up having to pin cloud-openapi to get it to pick up the new types in my local build - so I'm afraid I'm going to have to bat this back to you for you to approve the Cargo.toml changes or back them out - I am not sure what your preferred policy is with that library.

Plus the rebase seems to have borked GH's signing verification. I hope I haven't messed up your branch - you might want to stake a snapshot before you pull just in case.

Apologies for not having this cleanly sorted for you!