Add DB migration to delete orphaned tokens

[seanh]

This should be merged after #8510 (which will make sure that we don't orphan any more tokens).

Checking what the SQLAlchemy query evaluates to:

$ make shell
>>> from sqlalchemy import select, and_, func
>>> str(
...     select(m.Token.userid)
...     .outerjoin(
...         m.User,
...         and_(
...             m.User._username
...             == func.substring(func.split_part(m.Token.userid, "@", 1), 6),
...             m.User.authority == func.split_part(m.Token.userid, "@", 2),
...         )
...     )
...     .where(m.User.id.is_(None))
...     .distinct()
... )
'SELECT DISTINCT token.userid \nFROM token LEFT OUTER JOIN "user" ON "user".username = substring(split_part(token.userid, :split_part_1, :split_part_2), :substring_1) AND "user".authority = split_part(token.userid, :split_part_3, :split_part_4) \nWHERE "user".id IS NULL'

Testing

1. Log in as devdata_user, go to http://localhost:5000/account/developer, and generate a token
2. Log out, log back in as devdata_admin, go to http://localhost:5000/account/developer, and generate a token, then go to http://localhost:5000/admin/users and delete devdata_user

At this point you should have two rows in the token table in your DB: one belonging to devdata_admin and one orphaned row belonging to devdata_user.

If you now run:

$ make db args='upgrade +1'

you should see Deleted 1 orphaned tokens and the devdata_user token should be deleted from your DB.

[marcospri]

Look good. I don't think it will be an issue to run it prod but we'll have to keep an eye while the migration runs 👍 .