Adds the grant lifecycle actions.

As with the attributes, everything is add_new_*, so an action the application declared itself wins.

Why upsert_from_tokens upserts

A consumer who re-consents to the same grant — or amends it via grant_management_action: "replace" — comes back with the same grant_id and fresh tokens. Inserting would violate the identity; upserting is the correct semantics, and means the callback controller does not have to check whether it has seen this grant before.