auth: Generate bearer token using OIDC Authorization Code flow

Instead of using the OIDC Direct Grant flow to generate bearer tokens
for Web API authentication, use the more secured Authorization Code
flow (as in webapp login) to avoid proxying SSO credentials from django
backend to Keycloak server.

As a consequence, previously stored encrypted tokens in webapp database
has to be removed as the encryption scheme has changed. Hopefully,
there is currently only a couple in production database generated by
swh staff members so the impact will be quite limited.