Adds the grant and token attributes, plus the unique identity on grant_id.

Everything uses Ash's add_new_* builders, so an attribute the application declared itself is left untouched. That matters: an app might want access_token as a different type for encryption, or expires_at without microseconds to match an existing column.