ndg_oauth_server enhancements

Adds:
* __password-based client authentication__, which is a commonly used client authentication method
* __resource authentication for the check_token endpoint__, to avoid brute-force attacks on token check; also provides a starting point for audience-restricted tokens and resource-restricted attribute release
* __return user attribute from check_token endpoint__, so that the resource knows what the user is; attribute name `user_name` according to [CloudFoundry](https://github.com/cloudfoundry/uaa/blob/master/common/src/main/java/org/cloudfoundry/identity/uaa/oauth/RemoteTokenServices.java)

Resource and client authentication use the same classes, and now are instantiated with a string indicating their use (to give meaningful log messages). The client_authenticator interface was removed, since all authenticators can derive directly from authenticator_interface, since they're both used for clients and resources; they were also renamed to make that clear (removing `_client`).

In `client_register.ini` and `resource_register.ini` (the latter is new) the field `secret` is optional. The field `authentication_data` is still mandatory for clients, but I think it would make sense to make that optional as well, since it is not used for password-based client authentication. Resource authentication already has that (since it is new anyway).

Client code is unchanged.