Fix offline_as_scope option

[robbiemcmichael]

The offline_as_scope config option doesn't currently do anything because the variable gets overridden by the supported scopes from the OIDC issuer (or just set to true if the issuer doesn't advertise the supported scopes). This PR:

• Changes the OfflineAsScope config option to a *bool so that we can differentiate between intentionally set in the config file and omitted (if there's a better approach in Go, I'd be interested in knowing)
• Removes a previously unreachable condition based on the OfflineAsScope option
• Updates the template to hide the client-secret and refresh-token options in the kubeconfig file (idp-issuer-url and client-secret are both still required without a refresh token)

[fydrah]

It seems ok to me, thank you !
As I said in the README, I am not an expert with golang, so for the "better approach in Go", I can't tell you now :)

[robbiemcmichael]

Thanks for the info. It seems that my interpretation of the field was a little bit off as I wanted to use the config option to disable the offline_access scope. This is useful when using a Dex connector that doesn't support refresh tokens.

I'll have another look at the access_type field and see if I can submit another PR that captures the two separate use cases.