feat: blocklist to revoke jwt tokens after logout

[MaferMazu]

Description

Fixes a security report regarding stateless JWTs remaining valid after user logout. Although the session is invalidated on logout, active JWTs could still be re-used via API calls (e.g., via curl).

To address this, we implemented a custom JWT blocklist mechanism stored in cache to revoke tokens upon logout forcibly.

Changes:

• Added a JWT blocklist mechanism stored in cache.
• Updated the authentication decorator to check against the token blocklist.
• Revoked active user tokens immediately upon logout.

Note: This change is not needed in upstream. There is an ADR about it: https://github.com/openedx/openedx-platform/blob/master/openedx/core/djangoapps/oauth_dispatch/docs/decisions/0009-jwt-in-session-cookie.rst. But for stricter access, we implement this for a specific client.

How to Test

• Check out this branch (Teak env: tutor<21.0.0).
• Log in with any test user and copy the JWT token/curl request. (I was copying the curl request that came from the network in the web inspector when I performed this call: http://studio.local.openedx.io:8001/api/contentstore/v2/home/courses?page=1&order=display_name)
• Log out of the session.
• Attempt to make an authorized API call using the previous curl request.
• Expected result: The request should fail (Unauthorized / Invalid Token).

[felipemontoya]

esto esta raro, no te parece? Perfectamente podríamos poner la clase BlocklistJwtAuthentication en la línea 123 directo.