feat: list active user sessions

[oleobal]

Description

Requires Substra/substra-backend#698

Closes FL-1145

How to test

Notes for developers and reviewers:

• Think to update CHANGELOG.md before merge if needed !

[linear]

FL-1145 Make sessions visible on the frontend

Context

There are three types of sessions a user can start:

• Logging in on the frontend: JWT
• Logging in the SDK via Client.login: implicit bearer token (IBT)
• Creating an API token in the front: bearer token (BT)

Only BTs are visible to the user via the "API tokens" page.

This is a security anti-pattern, it should be possible for users to see the entire list of active sessions on the frontend, and terminate them if they wish (= a button send a signal to the backend that the token should be revoked)

Specification

Implementation will differ for JWTs and IBTs.

IBTs: implementation is easy, it's the same as with the regular tokens

JWTs: are they even revokable from the API?

Thought needs be given to UI (see David Endico)

Probably make a new page, call it "active sessions" that has both JWTs and IBTs.

Acceptance criteria

Users can see and terminate sessions on the frontend

[oleobal]

to be reopened one day maybe