GitHub: OAuth app token and grant revocation endpoints

Problem

GitHub lets an OAuth app revoke a user's token with DELETE /applications/{client_id}/token, or the whole grant and every token it issued with DELETE /applications/{client_id}/grant, authenticated with the app's client ID and secret. The emulator only offers revocation from the user's settings page, so an app's sign-out or token cleanup flow, and tests asserting that a revoked token stops working, cannot be represented.

Proposal

• Add DELETE /applications/:client_id/token and DELETE /applications/:client_id/grant, authenticated with the app's client credentials over HTTP Basic, taking access_token in the JSON body and returning 204.
• Return 404 for wrong client credentials and 422 for a token that is unknown or belongs to another app, and reuse the settings page's grant revocation.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/github-oauth-token-revocation. Happy to open a pull request for it.