api/graph: validate OAuth grants when submitting build

An OAuth grants string can be supplied when submitting a build
manifest. Validate it to make sure it's well-formed.

api/graph/schema.resolvers.go

@@ -299,6 +299,13 @@ func (r *mutationResolver) Submit(ctx context.Context, manifest string, tags []s
 		return nil, secretsErr
 	}
 
+	if man.OAuth != "" {
+		_, err := auth.DecodeGrants(ctx, man.OAuth)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	var job model.Job
 	if err := database.WithTx(ctx, nil, func(tx *sql.Tx) error {
 		tags := strings.Join(tags, "/")