Implement OAuth provider in CDot

### Background:

Previously Arrow system talks to Gitlab Platypus API endpoint(and then Platypus talks to CustomersDot). We will remove Platypus in this communication chain.
- previously(as of today):  `Arrow -> Platypus -> CustomersDot`
- after removing Platypus, Arrow will directly talk to CustomersDot:  `Arrow -> CustomersDot`

In order to achieve this, there are several changes required on CustomersDot side.
1. implement OAuth provider in CustomersDot. This allows secure API access control. We propose to use `doorkeeper` gem.
2. add required data mapping in CustomersDot. This maps some Arrow payload data to the CustomersDot/Zuora/SFDC required values.
3. track the Arrow order status. The status is used to: allow Arrow to poll the order status; validate duplicate requests; ensure to take action safely only on the right order status.
4. provide API endpoint for Arrow to poll the order status.

For more information, refer to the task breakdown at https://gitlab.com/gitlab-org/customers-gitlab-com/-/issues/4637#note_1062429151.

### This issue's scope

This issue covers the first task `implement OAuth provider in CustomersDot`

#### Proposal
   * Use `doorkeeper` gem. Follow the documentation https://doorkeeper.gitbook.io/guides/ to configure and coding. 
     * For the marketplace, we only need to secure API endpoint. So only support `client_credentials` flow is OK.
     * Configure scope(s)
     * **Question**: it seems we do not need to configure resource_owner_authenticator to secure API?
       * I skipped this part in my local configuration, and it works. All resource_owner_id is `null` in the `oauth_access_tokens` table. As in API, we only care about the client itself.
       * **Answer** I believe so for `client_credentials`.
          * The `client_credentials` grant type provides an application with a way to access its own service account. 
          * Marketplace application's `own service account` is the this Marketplace provider(e.g. Arrow)'s Zuora account. Once authenticated, the application has access to resources belonging to the Zuora subscriptions whose `invoice owner account is the Marketplace provider's Zuora account`. For example, such resources could be `status` in `MarketplaceOrder` table, Zuora subscriptions, etc.
          * In CustomersDot, one easy and reliable way to check whether a Zuora subscription is owned by a Marketplace provider is: check the `Zuora subscription's external_subscription_source == Marketplace provider's name`
          * In `POST /v1/orders`, we should always set the `external_subscription_source` -- We already did this.
          * In `GET /v1/orders/{external_subscription_id}`, we should only search subscriptions with `external_subscription_source == the Marketplace provider's name`.
          * The `Marketplace provider's name` should be discovered by `doorkeeper_token.application.name`. **NOTE**: for security reasons, we should **NEVER get this value from user input**(such as: request URL, request header, or request body). We should **ALWAYS get the value from the valid access_token**. This is important to ensure one Marketplace provider cannot create/query resources owned by other Marketplace providers.-- ATM we only have `Arrowsphere`, but in the future, we could have more Marketplace providers.
   * Generate `client_id`/`client_secret`(with `scope`) and send to Arrow.
     * we can do this through rails console `Doorkeeper::Application.create(name: "MyApp", redirect_uri: "", scopes: ["marketplace_order_create"])`
   * Arrow: update `client_id`/`client_secret`/`scope` generated from CDot

### Problem

### Proposal

<!-- Consult with `@gitlab-com/business-technology/enterprise-apps/zuora-architects` on the ~"Enterprise Applications" team if Zuora business logic is involved. -->

### Result

### Next steps (if any)

   * Generate `client_id`/`client_secret`(with `scope`) and send to Arrow.
     * we can do this through rails console `Doorkeeper::Application.create(name: "MyApp", redirect_uri: "", scopes: ["marketplace_order_create"])`
   * Arrow: update `client_id`/`client_secret`/`scope` generated from CDot
   * Arrow send API request to test the authentication

### How will we measure success?

Story points: 3.0