Secure storage of sensitive keys via OS Keyring

[fioan89]

For smooth login experiences we should persist in in the OS credential manager (Keychain on macOS, Windows Credential Manager, libsecret/keyring on Linux) the following:

• client id
• client secret
• refresh token
  Coder server implements Dynamic Client Registration (RFC 7591), each installation registers itself and gets its own unique client_id and client_secret, that can be stored in the OS keyring.
• CLI should also use keyring to securely persist access token in the OS Keyring

Other notes:

• access token, discard on exit
• access token expiry, needed only for the duration of the session
• code verifier, delete after token exchange
• state, delete after redirect verification

[fioan89]

Remaining work on this issue:

1. Linux keyring support.
2. Code verifier not wiped after token exchange — short-lived secret lingers in memory longer than necessary (defense-in-depth gap, not a persistence leak).
3. State not wiped after redirect verification — same lingering-in-memory issue.