collab: Add ability to revoke LLM service access tokens (#16143)

This PR adds the ability to revoke access tokens for the LLM service.

There is a new `revoked_access_tokens` table that contains the
identifiers (`jti`) of revoked access tokens.

To revoke an access token, insert a record into this table:

```sql
insert into revoked_access_tokens (jti) values ('1e887b9e-37f5-49e8-8feb-3274e5a86b67');
```

We now attach the `jti` as `authn.jti` to the tracing spans so that we
can associate an access token with a given request to the LLM service.

Release Notes:

- N/A

crates/collab/src/llm/db/queries/revoked_access_tokens.rs

@@ -0,0 +1,15 @@
+use super::*;
+
+impl LlmDatabase {
+    /// Returns whether the access token with the given `jti` has been revoked.
+    pub async fn is_access_token_revoked(&self, jti: &str) -> Result<bool> {
+        self.transaction(|tx| async move {
+            Ok(revoked_access_token::Entity::find()
+                .filter(revoked_access_token::Column::Jti.eq(jti))
+                .one(&*tx)
+                .await?
+                .is_some())
+        })
+        .await
+    }
+}