This came up adding a linter, and would also be an issue for codegen and
similar use-cases, where it is desirable to run CheckSchema before
loading in to a catalog

Just making some implicit things explicit

Addresses #1135

Revocation has similar properties to session refresh, so I implemented
it in `ClientSession` alongside `RefreshTokens`.

A high-level `Logout` helper has been added to `ClientApp` which both
revokes the tokens against the AS and deletes the session from the app's
session store.

Due to aforementioned similarity between refresh and revocation, I
created the `ClientSession.postToAuthServer` helper to reduce duplicated
logic. (Note that "DPoP retry" logic is still duplicated elsewhere, I
couldn't think of any elegant way to eliminate it)

Required according to rfc7523

Addresses #1152

This can be tested by initiating a login with the demo client app, but
hitting "cancel" on the AS login page (or by refusing to grant the
requested scopes).

The root cause was that this package was assuming that query and
procedure "params" were required, when they are actually optional.

This corrects them to be optional (pointer type), and skips validation
when nil.

Also adds "minimal" example schemas as regression tests.

Fixes: https://github.com/bluesky-social/indigo/issues/1153

I should probably add parsing helpers to the atproto/syntax package for
MIME type glob patterns, and for "service refs".

This isn't super rigorous yet, and it doesn't support pass-through of
extra fields on `permission` types. But it would catch early/initial
syntax issues, and could be used with `goat` for publishing and
resolving lexicons (eg, basic devex for permission-sets feature).