CloudFederationApi: access-token lifecycle fixes

[mickenordin]

Summary

Fixes three lifecycle bugs in the OCM access-token exchange

1. A refresh token (the OCM sharedSecret) can back several concurrent access tokens.

2. CleanupExpiredOcmTokensJob only deleted ocm_token_map not the access tokens in oc_authtoken

3. A new ShareDeletedEvent listener revokes all access tokens exchanged from the removed share's secret

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots N/A because only a backend change
• Documentation is not required
• Backports not neccessary
• Labels added
• Milestone added

AI (if applicable)

• The content of this PR was partly or fully generated using AI

[mickenordin]

I was able to verify this in my testrig:

kubectl --context ocm-test -n nextcloud exec alice-db-1 -- \
  psql -U postgres -d alice -c \
  "SELECT count(*) AS maps_for_secret
     FROM oc_ocm_token_map
    WHERE refresh_token = '<verysecret>';
   SELECT count(*) AS total_ocm_access_tokens
     FROM oc_authtoken WHERE name = 'OCM Access Token';"
Defaulted container "postgres" out of: postgres, bootstrap-controller (init)
 maps_for_secret 
-----------------
               3
(1 row)

 total_ocm_access_tokens 
-------------------------
                       3
(1 row)

Then after unshare:

kubectl --context ocm-test -n nextcloud exec alice-db-1 -- \
  psql -U postgres -d alice -c \
  "SELECT count(*) AS maps_for_secret
     FROM oc_ocm_token_map
    WHERE refresh_token = '<verysecret>';
   SELECT count(*) AS total_ocm_access_tokens
     FROM oc_authtoken WHERE name = 'OCM Access Token';"
Defaulted container "postgres" out of: postgres, bootstrap-controller (init)
 maps_for_secret 
-----------------
               0
(1 row)

 total_ocm_access_tokens 
-------------------------
                       0
(1 row)

[enriquepablo]

lgtm

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)