Consider allowing individual service object oauth2 configs to set custom `allowedAlgorithms`

[dlongley]

Right now we set allowedAlgorithms service wide -- we could allow an override by individual service object configs. Pros: flexibility, Cons: footguns.