feat(oauth): add refresh token and expiry support to OAuth token flow

[vinokurig]

What does this PR do?

Persist OAuth refresh tokens and expiration times in Kubernetes secrets alongside access tokens, enabling token refresh without re-authorization after server restarts.
Adds a POST /oauth/refresh endpoint, updates the OAuthToken DTO, PersonalAccessToken, and PersonalAccessTokenParams with refreshToken/expiresIn fields, and restores in-memory credentials from persisted secrets when the credential store is empty.

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://redhat.atlassian.net/browse/CRW-4121

How to test this PR?

1. Start Che from the che-server pull request image: quay.io/eclipse/che-server:pr-
2. Configure an oauth, e.g. for gitlab: https://eclipse.dev/che/docs/stable/administration-guide/configuring-oauth-2-for-gitlab/
3. Start a workspace from a Gitlab repository url, an Oauth token must be added to the user-preferences -> Personal Access Tokens tab
4. Restart the che-server pod to clear the oauth data from the che-server pod memory.
5. Execute the POST API request: <che host url>/api/oauth/refresh?oauth_provider=gitlab&provider_url=https://gitlab.com
6. Check the token secret, the token and the refresh-token data must be refreshed.

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Release Notes

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vinokurig

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-server:pr-1047

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-1047", name: che}]}}]"

[vinokurig]

/retest

[vinokurig]

/retest

[vinokurig]

/retest

[vinokurig]

/retest

[openshift-ci]

@vinokurig: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v19-gitea-no-pat-oauth-flow	a0ffc1c	link	true	/test v19-gitea-no-pat-oauth-flow
ci/prow/v19-github-no-pat-oauth-flow-ssh-url	a0ffc1c	link	true	/test v19-github-no-pat-oauth-flow-ssh-url
ci/prow/v19-che-smoke-test	a0ffc1c	link	true	/test v19-che-smoke-test

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.