Allow admins to revoke authentication tokens

[butonic]

Currently, users can revoke a token themselves. Admins should be able to revoke them as well to remain in control.

[butonic]

cc @danimo @felixboehm @ChristophWurst @DeepDiver1975

[PVince81]

Yeah, some ideas we discussed with @ChristophWurst for the UI:

• provide a search field in the admin page to be able to search for a user and then display that user's sessions with "Disconnect" buttons.
• maybe add a button "Disconnect all" too

Not sure if this should be a dedicated page.
Also thought about adding a link from the users page, but as I understand there are some user managers (shibboleth, IMAP?) where there is no user list so one still needs to be able to search by user to perform the operation.

[PVince81]

cc @tomneedham

I thought we had an occ command for this already

[tomneedham]

Whats the roadmap for these token with OAuth now here? OCC commands should be around as well.

[PVince81]

I'm moving this to triage for future scheduling. @pmaier1