OAuth implementation

[augustuswm]

This replaces the openid (Google) and access token (GitHub) authentication methods with an OAuth implementation. This implementation forwards authentication to Google or GitHub and transforms the returned user into an RFD API user. Changes here fix #1, #2, and #9.

There are still a few outstanding issues:

• All state for authentication attempts is stored in the database, which means if the state parameter is corrupted (or not returned) by a remote OAuth system we can not determine what login attempt the call was for. This likely needs to be fixed by storing short-lived session data on the client system prior to redirecting to the remote provider.
• Account merging is not implemented. If I log in with the Google and GitHub accounts that both have the verified email address of [email protected], the API will generate to separate user for each. In a future state, I should be able to log in to my RFD API accoutn via my Google account and then connect my GitHub account as an authn provider as well. This will require work to determine how to merge two or more RFD API accounts.

[inickles]

Suggested change

	clear: String,
	clear: secrecy::SecretString,

Sounds like a good candidate for secrecy::SecretString here.

[augustuswm]

This has been changed to a Vec<u8> and I'm looking at wrapping it with zeroize

[augustuswm]

This should be ready for initial review. Few known issues:

1. expires_at on LoginAttempt should not be optional
2. Access token duration is hardcoded instead of configurable
3. error_description and error_uri are not included when constructing failed redirect uris