fix: reject AT from banned users

[fadymak]

Reject requests from from banned users with still-valid access tokens.

The following endpoints will be affected:

User & session

Method	Path	Handler
GET	/user	UserGet
PUT	/user	UserUpdate
GET	/reauthenticate	Reauthenticate
POST	/logout	Logout (now also blocked for banned users)

Identities & OAuth grants

Method	Path	Handler
GET	/user/identities/authorize	LinkIdentity
DELETE	/user/identities/{identity_id}	DeleteIdentity
GET	/user/oauth/grants	UserListOAuthGrants
DELETE	/user/oauth/grants	UserRevokeOAuthGrant
POST	/token?grant_type=id_token (with link_identity=true)	IdTokenGrant (via direct requireAuthentication call)

MFA / factors

Method	Path	Handler
POST	/factors	EnrollFactor
POST	/factors/{factor_id}/challenge	ChallengeFactor
POST	/factors/{factor_id}/verify	VerifyFactor
DELETE	/factors/{factor_id}	UnenrollFactor

Passkeys

Method	Path	Handler
POST	/passkeys/registration/options	PasskeyRegistrationOptions
POST	/passkeys/registration/verify	PasskeyRegistrationVerify
GET	/passkeys	PasskeyList
PATCH	/passkeys/{passkey_id}	PasskeyUpdate
DELETE	/passkeys/{passkey_id}	PasskeyDelete

OAuth server (OIDC)

Method	Path	Handler
GET	/oauth/userinfo	OAuthUserInfo
GET	/oauth/authorizations/{authorization_id}	OAuthServerGetAuthorization
POST	/oauth/authorizations/{authorization_id}/consent	OAuthServerConsent

[cstockton]

Looks good to me