OAuth cleanup round... 5?

OAuth smoke and mirror indirection is coming to an end. Through tracing code, I've found that we only actually issue Bearer tokens. I've renamed accordingly, and flattened a complex cache mapping. I also flattened a boatload of complexity around algorithm mapping. Considering everyone is using RS256, we can simplify greatly (and I did just that).

TODO for implementors (aka @ccustine)
 * Use OAuthModule, not OAuthAuthenticationModule
 * Use OAuthFilter, not OAuthAuthenticationFilter
 * else is the same

Details.
     * Refactor OAuth to be less complex.
     * Remove oauth as a standalone api.
     * Rename redundant OAuthAuthenticationFilter to OAuthFilter.
     * Make AuthorizationApi more simple by using form semantics.
     * Simplified OAuth by only permitting RS256 and none algos.
much simpler than the weird `Function<byte[], byte[]>` indirection, right?