Refactor session handling

[myssto]

Unblocks osu-tournament-rating/otr-api#476
Closes #134
Part of #220

All of the changed code that makes calls to the otr-api now use the @osu-tournament-rating/otr-api-client package. These changes break almost everything on the site because of the partial adoption of the api client package, but @AkinariHex and I have agreed that is fine for now. Once this is merged we will work on refactoring the rest of the server side code to adopt the api client.

Changes:

• Adds CSRF protection to login with a state variable
• Refactors (and abstracts some) server actions that pertain to login / logout / session management
• Site middleware and api wrappers will now silently refresh the access token when necessary
  • Will also logout the user when the refresh token is invalid

[AkinariHex]

Lot of changes applied but we watched together these changes a little bit, like that we made a big refactor.
I feel good with that if you tested that works as before, also we can check last things together if unsure.

[hburn7]

Please ensure things aren't "more broken" than they were before, if possible.

[AkinariHex]

This is why I am waiting myssto, I want to merge the PR with him in a call so we can see if something is broken and hotfix it.
As we saw already the login and revalidation is much more smoother now, like 200% better.