Add endpoint to log in with OAuth access token

@aleffert @rlucioni 

FYI @nasthagiri @dianakhuang @johncox-google

I dislike the fact that we have to poke the session to pass information to the pipeline. I'm wondering if we should change parse_query_params to not require auth_entry to be set in the session (and instead pass is_api as a kwarg to the pipeline), but I haven't fully thought through the ramifications of that change. I'm also not at all tied to the format of the responses from the new endpoint. If you can think of something better, let me know.
@nedbat Since you're now already tagged on this PR, I'm curious to hear your thoughts on this.  
The advantage of using duck typing here is that any authentication-backend (not just OAuth) that implements `do_auth(access_token, ...)` would automatically work with this new code.  However, the disadvantage of using duck typing is that we may be introducing inadvertent error conditions if a backend's implementation of `do_auth` is semantically different from what we expect.