Fix OPENIG-195: Implement OAuth 2.0 Client support

Main entry point is OAuth2ClientFilter

Supports:

* OAuth 2.0 "authorization code" grant type
* automatic token refresh
* proactive and reactive authorization for SSO
* user initiated login / logout
* OpenID Connect Relying Party
* OpenID Connect discovery via "well-known configuration"
* multiple providers and optional "Nascar" page
* session based persistence
* CSRF prevention via 160 bit state nonces
* manually tested against OpenAM 11 and Google.

TODO:

* more unit testing
* cookie based session management via encrypted JWT tokens
* attribute mappings per provider? (TBD)
* consider replacing default login/logout URLs with handlers?


git-svn-id: https://svn.forgerock.org/openig/trunk@424 dbb9e58e-28e6-4ce0-90e8-f11d9605b710
Additional fix for OPENIG-207: move legal-notices to WEB-INF folder.


git-svn-id: https://svn.forgerock.org/openig/trunk@425 dbb9e58e-28e6-4ce0-90e8-f11d9605b710