fix: fix the refresh token issue

[wood-push-melon]

This pull request tries to fix the refresh token not issued problem in device flow. Also tries to make some corrections in the tests.

Question:

• Not sure when the client will be a ClientWithCustomTokenLifespans. But from this line, do we need to also add something for device flow grant type in here?

[nsklikas]

I tried this with hydra and the refresh token is still not issued, is this supposed to fix the bug or is there work that needs to be done in hydra for this?

[wood-push-melon]

I tried this with hydra and the refresh token is still not issued, is this supposed to fix the bug or is there work that needs to be done in hydra for this?

Took another look at the Hydra and Fosite. From what I understand, I think the endpoint /oauth2/device/verify missed granting the scopes to the authorize request. It did update the granted scopes at this line. However, it does not store the updated authorize request.

With the regular OAuth2 flow, the updated authorize request is stored at this line call. So the access token request handler can use the granted scopes in the authorize request to see if a refresh token should be issued.

We can sit together after the daily to have a walkthrough.

[nsklikas]

Actually I have one minor comment