Do not delete invalid AppToken

[rullzer]

When an apptoken is still valid in the DB but the password validation fails we should mark it as such. That way we can on next (successful) login update all the tokens that are marked as invalid.

For https://github.com/orgs/nextcloud/projects/22

This should make changing the password in LDAP possible for example.

TODO:

• Add field to mark apppassword as outdated to DB
• If the password fails to verify mark the apptoken as outdated (do not delete it)
• On successfull login update outdated tokens