OAuth2 authentication - #1325

@JoHaHu I hope this is welcome rather than intrusive — this PR had been quiet for a while and no longer merged, so I picked it up rather than opening a competing implementation: #1378, with #1377 as the issue describing the scope.

Your approach is the one in it, unchanged in substance: token-first only, and a token-provider closure called per connection attempt. What I added is a rebase onto current master, the RFC 7628 Sec. 3.2.3 failure round (so a rejected token surfaces the server's own error instead of "unexpected message"), tests, and docs. One thing worth flagging in case you want to fix it here instead: authenticate_oauthbearer consumed the AuthenticationOk message, but authenticate() reads that itself after the SASL helper returns, so a successful exchange would have failed with unexpected message from server. Easy to miss without a validator-equipped server to test against.

If you would rather carry this forward yourself, say so and I will close #1378 — I have no attachment to it beyond wanting the feature to land. Either way the credit is yours, and it is in the commit message.