invalidate oauth2 tokens only for seen users

[individual-it]

• Resolves: [Bug]: deleting oauth client does not delete the tokes given out by the client #35068

Summary

This is a follow-up PR for #36033 to make sure tokens are deleted only for seen users, see discussion in #37230 (comment)

CC @blizzz

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
  • stable26: [stable26] invalidate existing tokens when deleting an oauth client #37230
  • stable25: [stable25] invalidate existing tokens when deleting an oauth client #37231

[blizzz]

Due to the branchoff this week, it also needs a backport to stable27.

[individual-it]

@icewind1991 I'm not clear what to do with this. @blizzz said in #37230 (comment) that it should go in a background job

[skjnldsv]

This is an old PR, but should be alright!
Le me take over and help get this in for 31!

Thank you for the great work @individual-it 💪