feat: handle concurrent refreshes and improve graceful refreshing

[aeneasr]

This patch improves Ory Hydra's ability to deal with refresh flows which, for example, concurrently refresh the same token. Furthermore, graceful token refresh has been improved to handle a variety of edge cases and scenarios.

Additionally, serializability errors in CockroachDB are now correctly retried.

Related issue(s)

See https://github.com/ory-corp/cloud/issues/7311
Closes #3895

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  security@ory.sh) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

[alnr]

difficult to test programatically I guess

[aeneasr]

We do have tests in network for this so if it passes there it's fine here too

[aeneasr]

difficult to test programatically I guess

It actually wasn't that hard other than that the test tooling isn't great :) I've added a test case

[aeneasr]

ory/fosite#838

[alnr]

This is a dense change. I did not see anything wrong with it.

[zepatrik]

It's super hard to review with all the parallel refactoring. I know that you already put in a lot of work, but maybe you could still pull out the refactoring into a separate PR? Especially refactoring and changing of relevant test cases at the same time gets super hard to review 😅

[aeneasr]

It's super hard to review with all the parallel refactoring. I know that you already put in a lot of work, but maybe you could still pull out the refactoring into a separate PR? Especially refactoring and changing of relevant test cases at the same time gets super hard to review 😅

I had to change the tests because I was not able to test parallel refresh grants in SQLite. So I had to change the test suite to use cockroach etc.

If you review it in IntelliJ and hide whitespace changes it should be much easier to review

[aeneasr]

And the graceful refresh token rotation tests I had to anyways rewrite because the test suite was not effective.

[zepatrik]

All LGTM, especially test improvements 👍

[hperl]

LGTM! The review comments were quite helpful in understanding the change, thanks!

[aeneasr]

I confirmed that a refresh token created before this patch also works after this patch.