Support GitHub OAuth app token and grant revocation

• Add DELETE /applications/:client_id/token and DELETE /applications/:client_id/grant, authenticated with the app's client credentials, revoking one token or the user's grant and all its tokens, with 422 for a token that is unknown or belongs to another app and 401 for wrong client credentials.
• Return 401 Bad credentials for a revoked token in every mode, instead of falling back to the default user, and share the grant revocation with the settings page, with regression coverage and docs.

References:

• Both endpoints, Basic authentication with the client ID and secret, 204 and 422, and a deleted grant removing the app's access and tokens: https://docs.github.com/en/rest/apps/oauth-applications
• Invalid credentials return 401 Unauthorized: https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api

Fixes #363