Feat(oauth): add revoked_tokens table migration

Solves part of gitlab-org/gitlab#602674 (closed)

Introduces the Postgres/YugabyteDB persistence layer for IAM OAuth token revocation (#602674). One row per revoked jti, keyed on jti (PK) with an expires_at index for the future TTL cleanup sweep.

Added to both db/migrations/postgres and db/migrations/yugabyte; the Yugabyte copy carries -- +goose NO TRANSACTION since YB cannot run this DDL inside goose's default transaction. DDL is otherwise identical. Verified applied on both backends; squawk-clean.