Fix OpenIdApplicationStep to remove permissions for flows that are no longer enabled

[kevinchalet]

#10136 updated OpenIdApplicationStep to support updates but unfortunately, permissions removal was not implemented: if you remove an allowed flow from an already configured recipe, the permissions corresponding to that flow (grant type permissions, endpoint permissions and response types permissions) must be removed too (otherwise, the flow is still considered allowed).

Basically, the same logic present in ApplicationController.Edit() should be used in the recipe step.

[kevinchalet]

/cc @deanmarcussen