Add a ROTATE_REFRESH_TOKEN setting to control whether refresh tokens are reused or not

[synasius]

#389 added the ability to reuse old refresh token.

To enable this behavior, one should extend the OAuth2Validator class, reimplement the rotate_refresh_token method to return False instead of True and set the OAUTH2_VALIDATOR_CLASS setting to the custom class path.

It could be easier if we add a boolean ROTATE_REFRESH_TOKEN setting that is used in a default implementation of the rotate_refresh_token method:

def rotate_refresh_token(self, request):
    return oauth2_settings.ROTATE_REFRESH_TOKEN

[silvanocerza]

Merged in 653b84e