OIDC: refresh grant improperly handles new refresh_token

[takuy]

Preflight Checklist

• I have completed all Troubleshooting Steps.
• I'm on the latest version of Directus.
• There's no other issue that already describes my problem.

Describe the Bug

When using an OIDC provider that provides a new refresh_token on a refresh grant flow, the old refresh_token is invalidated. Directus should be able to handle this by storing the new refresh_token in place of the existing refresh_token.

See discussion #10148 for further details.

To Reproduce

Use an OIDC provider that provides a new refresh_token and new access_token on a refresh grant.
See discussion #10148 for further details.

Errors Shown

Directus simply says the refresh_token is invalid. Server side logs:

Dec 01 01:07:51 simplesamlphp DEBUG [21cd28ea1b] Token Request: {"grant_type":"authorization_code","code":"<snip>","redirect_uri":"http:\/\/mydomain.com\/directus\/auth\/login\/sso\/callback","code_verifier":"<snip>"}
Dec 01 01:07:51 simplesamlphp DEBUG [21cd28ea1b] Token Response: {"id_token":"<snip>","token_type":"Bearer","expires_in":3600,"access_token":"<snip>","refresh_token":"<refreshtoken1>"}
Dec 01 01:07:51 simplesamlphp DEBUG [61a0e80b4b] Token Request: {"grant_type":"refresh_token","refresh_token":"<refreshtoken1>"}
Dec 01 01:07:51 simplesamlphp DEBUG [61a0e80b4b] Token Response: {"id_token":"<new id token>","token_type":"Bearer","expires_in":3600,"access_token":"<new access token>","refresh_token":"<refreshtoken2>"}
Dec 01 01:07:52 simplesamlphp DEBUG [105214b31c] Token Request: {"grant_type":"refresh_token","refresh_token":"<refreshtoken1>"}
Dec 01 01:07:52 simplesamlphp ERROR [105214b31c] SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException: The refresh token is invalid.

What version of Directus are you using?

9.1.2

What version of Node.js are you using?

Whatever comes with the Docker container

What database are you using?

MariaDB 10.4

What browser are you using?

Chrome

What operating system are you using?

RHEL 7

How are you deploying Directus?

Docker

[aidenfoxx]

This affects a minority of providers. Will have a PR to handle this tomorrow.