Store grants

[rien]

Some OAuth2 clients could require grants: the user has to explicitly allow an application to act on their behalf. We currently show the grant screen every time the user performs the authorization flow for such a client. We can avoid this by storing the grants in the database.

This should be as easy as creating a new grants table which has records linking a user and a client (possibly with some metadata like grant time).