WIP: security: client blocklist

This implements the configurable client blocklist discussed on #944 (closed) as well as sets up the block on Tootdon.

WIP because we still need to find a way to revoke the credentials of blocked apps. Most likely passively, I guess.