Support revoking Okta user sessions

• Add DELETE /api/v1/users/:userId/sessions, returning 204 and, with oauthTokens=true, revoking the OAuth access and refresh tokens issued to the user.
• Keep tokens when oauthTokens is omitted, as it defaults to false, with regression coverage and docs.

References:

• Revoke all user sessions, the oauthTokens parameter and its false default, and the 204 response: https://developer.okta.com/docs/api/openapi/okta-management/management/tags/usersessions/other/revokeusersessions

Fixes #368