feat(#3635765): issue preview tokens with Simple OAuth and limit preview target hosts

Adds a [preview_token] URL token, so a frontend on another domain or a tunnel can read an unsaved preview without the editor's cookie. With Simple OAuth installed, it is an access token for the editor, issued to the target's consumer with the scopes of an Authorization Code sign-in, and Simple OAuth accepts it as a bearer token. Without Simple OAuth it is empty. An allowed target hosts list limits where targets can point, and a Preview tab beside Consumers sets the hosts, the token lifetime and the target expiry limits, which move from $settings to config