IdpRevocation - temper

What happened to the stored grant at the identity provider.

A three-state enum rather than a bool, because false used to collapse
three genuinely different facts — "there was no grant, so nothing was
attempted", "a revoke was attempted and failed", and (in AS mode) "the
UPDATE matched zero rows" — and consumers could not tell them apart. The CLI
consequently warned "the identity provider did not confirm revocation" at a
user who had no grant at all.