WIP: security: client blocklist
This implements the configurable client blocklist discussed on #944 (closed) as well as sets up the block on Tootdon.
WIP because we still need to find a way to revoke the credentials of blocked apps. Most likely passively, I guess.