This change simplifies the `oauthdevice.Authenticator` interface from
the two-step `FetchCode` + `FetchToken` to a combined single method
`Authenticate` that essentially chains the two code paths. The former
interface may over-fit the device code auth flow, whereas the new
interface may allow for non-device-code-flows to be implemented in the
future.

Since this change causes the interface to no longer be
device-code-specific, the former package name no longer makes sense.
This change results in the following renames:

`package oauthdevice` -> `package auth`
`oauthdevice.Authenticator` -> `auth.Backend`
`oauthdevice.Auth` -> `auth.DeviceCode`
`oauthdevice.NewAuth` -> `auth.NewDeviceCode`

This change moves the browser-opening step from `main` into
`auth.DeviceCode` as a consequence (which more accurately reflects
the reality that not all auth flows involve opening a browser). Tests
for main are simpler but tests for `auth.DeviceCode` are more complex as
a result.

Tests for `auth.DeviceCode` mock the underlying transport to perform
validation on the HTTP requests and responses, bringing some of the
`oauth2` package logic into the test. This results in slight
over-testing, but may allow us to more easily validate `engflow_auth`
against actual HTTP responses from our oauth endpoint in the future.

This change modifies the HTTP client used by the `DeviceCode`
Authenticator implementation to send version information in each
request.

The version info is sent in the `User-Agent` header, using the format:

    engflow_auth/vX.Y.Z

The version string is generated by the `buildstamp` library and is a
semver string in a release binary, or a "pseudoversion" in a dev binary,
similar go Go module pseudoversions.

Tested: 
* Added unit tests
* `bazel run //cmd/engflow_auth` against dev cluster fails (no
buildstamp info)
* `bazel run --stamp //cmd/engflow_auth` against dev cluster succeeds

Bug: linear/CUS-387