auth/backends: Use offline refresh token for Web API authentication

For commodity of use for Web API users, simplify the OIDC authentication worflow
by handling access token renewal directly in the DRF authentication backend.

This means once a user gets his offline refresh token, he can store it and uses
it to authenticate all his API calls until the token gets revocated.

To limit the number of requests sent to the authentication provider (Keycloak),
access tokens are put in cache until they expire (usually a couple of minutes).

Related to T1927