Move client authentication into token handler

Section 9 of the OpenID connect spec lists various options for client
authentication in addition to Basic authentication, which has been the
only supported option so far. Processing the different parameter
combinations fits better with the token endpoint code running in EitherT
than it does in Scotty.

- Move client authentication from scotty into processTokenRequest
- Add the authorization header as a parameter to the function
- Add the structure for non-Basic auth mechanisms

Implementations need to be added for client_secret_post and
client_assertion.