[PoC] Adds FxA OAuth support

### Proof of Concept 

ref https://bugzilla.mozilla.org/show_bug.cgi?id=1022064
Convict can validate nested objects. If you want convict to handle this, configure each key in the object rather than the object itself, e.g. give `scopes` a format of `String` and a default value of `null` to make it required, or just give it a sensible default value, then do the same for the rest of the keys.