This leverages the existing `sync_external_users` cron job to
synchronize the IsActive flag on users who use an OAuth2 provider set
to synchronize. This synchronization is done
by checking for expired access tokens, and using the stored refresh
token to request a new access token. If the response back from the
OAuth2 provider is the `invalid_grant` error code, the user is marked
as inactive. However, the user is able to reactivate their account by
logging in the web browser through their OAuth flow.

Also changed to support this is that a linked `ExternalLoginUser` is
always created upon a login or signup via OAuth2.

…h2-users