OAuth client SDK

[bnewbold]

Design goals:

• specific to atproto OAuth (not a general-purpose OAuth framework)
• implementation is correct and interoperable with atproto specification
• reasonably complete and flexible, though may make some opinionated implementation decisions to avoid footguns
• compatible with client SDK (aka, implement AuthMethod)
• oriented towards server-side (eg, BFF and integrations)
• supports "just authn" use-cases

Progress:

• basic confidential client demo web interface
• public client mode
• localhost dev client mode
• refactor core types and method attachments (eg, a session-agnositc OAuthClient struct with http.Client)
• persist token callback (wired to ClientApp)
• make PAR DPoP retries more specific (parse error response)
• fix DID/handle display in demo app
• ability to embed JWKs in client metadata directly (blocked on needing key_ops?)
• resolve XXX and TODO