Add config to disallow manual double puppeting

[AndrewFerr]

as some instances may want to discourage users from sharing their Matrix access tokens.

Disabling manual double puppeting still allows automatic double puppeting for any server configured with a login shared secret.

If both manual and automatic double puppeting are enabled for a user, allow login-matrix to replace the server-managed Matrix token with the one given by the command.

Also add the refresh-matrix command to fix potential issues with automatically-managed double puppet sessions.