IAM should expire unused refresh tokens after a configurable amount of time

[andreaceccanti]

To avoid the pileup of unused refresh tokens in the database. To implement this functionality, IAM needs to keep track of when a refresh token was last used.

It should be possible to disable the refresh token cleanup for selected clients.

[enricovianello]

This issue is linked to #675 and #680 .
Deleting unused client has the consequence of delete all the related token.
It's a different point of view deleting unused clients but it should give the same results.