Add ScimClient model

[NobodysNightmare]

Including basic services to manipulate them. The
service account is managed as part of the ScimClient's lifecycle.

We make sure to revoke non-chosen authentication methods with every update, so that it's not possible to keep authenticating through an outdated (and most likely UI-invisible) method anymore.

Ticket

https://community.openproject.org/work_packages/62516/activity

What are you trying to accomplish?

To process SCIM requests we need to authenticate an entity during the corresponding API requests. This must be possible via three high-level methods:

• JWT token from an identity provider
• access token issued by OpenProject Doorkeeper::Application
• static token issued "by OpenProject"

Which approach did you choose and why?

The ScimClient is the central entity to configure settings around a configured SCIM client. It's related to a user (new subtype ServiceAccount) and optionally an oauth application. The service account is the authenticated entity. In this model we can cover all three authentication modes:

• JWT token is natively supported by adding an identity_url to the service account
• access token and static token can both be supported through a Doorkeeper::Application that uses the service account as a client credentials user
  • static token is a special case of this config, where we directly offer a token created for this oauth app to the user, without really performing an oauth token request

Merge checklist

• Added/updated tests