Avoid removing TrustedClient tokens after a password reset

[OmarIthawi]

This is a chery-pick from Hawthorn (appsembler#398). It needs rebasing, but I'll do that after product review.

What's the Issue?

We found out that both of the Access and Refresh tokens of a TrustedClient are removed after a password reset by the destroy_oauth_tokens method.

These tokens should only be removed for untrusted clients such as mobile apps or third party apps. A trusted client such as the edX Marketing site (for example) should retain those tokens and only be removed in the case of a marketing site security compromise.

This pull request fixes the issue by avoid removing the tokens for TrustedClients.

See: https://courses.edx.org/admin/edx_oauth2_provider/trustedclient/

[openedx-webhooks]

Thanks for the pull request, @OmarIthawi! I've created OSPR-3665 to keep track of it in JIRA. JIRA is a place for product owners to prioritize feature reviews by the engineering development teams.

Feel free to add as much of the following information to the ticket:

• supporting documentation
• edx-code email threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will still be done via the GitHub pull request interface. As a reminder, our process documentation is here.

[feanil]

@OmarIthawi I'll put this in the product review queue .

FYI @marcotuts

[marcotuts]

Ok to move this to engineering review next, I don't have any specific product feedback. Will need to make sure we address security needs as part of that.

[OmarIthawi]

Thanks @marcotuts and @feanil!

[edx-status-bot]

Your PR has finished running tests. The following contexts failed:

• jenkins/quality
• jenkins/python
• jenkins/bokchoy
• jenkins/a11y

[OmarIthawi]

Thanks @edx-status-bot, I'm aware of that. I need the code to be reviewed first, and I'll fix those issues afterward.

Your PR has finished running tests. The following contexts failed:

• jenkins/quality
• jenkins/python
• jenkins/bokchoy
• jenkins/a11y

[natabene]

@ormsbee This is ready for your review when you have a chance.

[natabene]

jenkins run quality

[OmarIthawi]

Thanks @natabene! I was just testing if those commands still work.