[gateway] [oauth2] add an option to not rotate refresh tokens

[exalate-issue-sync]

📗 Feature

Currently AM always rotate refresh token (a refresh token is only valid once).

For convenience reasons, it can be good to not rotate refresh tokens and re-use refresh token until it expires.

📑 Additional information

This option will be disabled by default to follow best security practices.

🖌️ Design

Link to Figma

Mockups

Unable to render embedded object: File (/secure/attachment/10336/10336_Capture d%E2%80%99e%CC%81cran 2022-12-07 a%CC%80 00.16.00-20221206-201605.png) not found.

📋 Acceptance Criteria

Acceptance criteria 1

Given: A user wants to get a new access token with refresh_token flow

When: The user call the /oauth/token endpoint with the same refresh token multiple times

Then: No error should be displayed and an access token with the same refresh token is displayed to the user