Follow-up to T412214: Ensure a good experience for apps which want to use OAuth credentials for a long time (refresh token grace period).

In T412214#12034419, @Tgr wrote:

Reusing a refresh token in its grace period will let the client create several valid new refresh tokens, which doesn't seem ideal from a security POV (although it doesn't seem like a huge deal either). I don't think that's easy to fix. There's an upstream proposal (oauth2-server#1506) to handle it in the oauth2-server library.