[Auth] Allow indefinite refresh token reuse

With Supabase refresh token expires after 10s (default value) after reused, whilst seemingly secure it poses some challenges to reliably extend session without losing user session:

Such option, especially combined with ability for user to display all valid sessions (I mean refresh tokens): doesn't need to be necessarily less secure (after all, most session based systems does that). This may simplify integrations where you may want to share user "session" (refresh token) non-interactively to other system component without requiring user email/password.

That's also what Firebase does:

Source:

There are lots of other APIs (e.g. Dropbox) where refresh token doesn't expire until revoked manually.

In summary, I believe it would be beneficial to have a configuration setting where "refesh_token" once reused:
• wouldn't become invalidated after 10s,
• wouldn't generate a new refresh token