Rolling changes to client_id

[ThisIsMissEm]

From time to time I come across people using unstable URLs for semi-production ready apps, for instance, this one from SafeSkies (a bluesky moderation app) — whilst they have the domain https://safeskies.app/ which is where you're redirected to, it seems the client_id that they use has become an internal heroku URL that backs that domain.

prod-safe-skies-api-231a3f5f5b17.herokuapp.com/oauth/client-metadata.json

We should probably figure out some way for that client_id to signal "hey, I'm actually https://safeskies.app/oauth/client-metadata.json — perhaps through redirect handling or signing or something?

[ThisIsMissEm]

@aaronpk I don't have a good solution here, since #46 prohibits redirects. The only way I could think of supporting this would be to have something like a previous_client_ids array in the resulting document, but even that would be unsafe, I think?