Add service class to generate Duo Workflow token

What does this MR do and why?

• This will be invoked by the API endpoint that is being created via this issue: #470128 (closed)
• This MR copies the approach used by the Web IDE to generate an OAuth application on the fly if one does not already exist.
  • Related MR 1: Db migrations for IDE OAuth (!137212 - merged)
  • Related MR 2: !138015 (merged)
• This adds a FK duo_workflow_oauth_application_id from application_settings to oauth_applications
• Closes #470862 (closed)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

How to set up and validate locally

1. In rails console enable the Duo Workflow feature flag

   Feature.enable(:duo_workflow)

2. Invoke the class

   Ai::DuoWorkflows::CreateOauthAccessTokenService.new(current_user: User.first).execute

3. Response should be a ServiceResponse with an http status of ok. The response also should have a Doorkeeper OAuth token with an ai_workflows scope