SSP-1387 Add OAuth2 client_credentials AuthZ Grant Type support

OAuth2 Clients are in the database as an extension of Person. We
still need database-persistent Tokens, and a way to manage Clients
from the UI/API layer.

Clients are an extension of Person because under a client_credentials
Grant, the Client *is* the user, so it must be the object referenced
by our "audit" fields (created_by, modified_by). I would have
preferred to refactor those relationships to add an abstraction
"on top" to generalize the notion of an interactive agent. Something
like:

      Account <-- [Entity].modifiedBy|createdBy
        /  \
       /    \
  Client   Person

That way we wouldn't accidentally return Clients when searching
for "normal" users suitable for adding to caseload, etc.

But I decided that sort of change was simply too invasive for our
schedule. So I just made Client (OAuth2Client, actually) a subclass
of Person. Then the only changes necessary were effectively localized
to our SecurityServiceImpl which needed additional logic to know
how to convert the Principal on a OAuth2Authentication to a SspUser.
Student search still effectively functions just fine since
OAuth2Clients never have a studentType. But we still might need
to refine that filtering further. And in the long run I'd still
like to make OAuth2Client a sibling of Person rather than a child.

Also suspect there are some performance issues that will need to
be addressed, specifically around eager loading of GrantedAuthorities.