offline_access scope support

[telyn]

The offline_access scope defined in the OIDC specification appears to be completely unsupported as yet.

So as to not break peoples' existing oidc flows it would probably be prudent to put this in behind a config option.

I think for the application I'm working on it's not security-critical to have this feature, but if I find out otherwise I'll likely end up implementing it in Q1 / Q2 2021.

[phlegx]

@telyn do you use offline_access? Have you implemented this feature?

[telyn]

@phlegx no - if memory serves we noted it down as a minor risk and went on with our lives after opening this issue.