Refactor OAuth so that it doesn't require private keys when we aren't signing anything

Now, we can safely use bearer tokens or "none" alg without guice crapping out. I also refactored naming of things.

As always in this api, there's more shoveling to do, but this is certainly a step forwards cognitively and also from a tech debt pov.

replaces #87

 * Refactor OAuth so that it doesn't require private keys when we aren't signing anything.
 * Rename constant `serviceAccountCredentials` to `p12PrivateKeyCredentials` as this better describes the credential value.
I guess the idea behind FIX_ME was that users would specify that property themselves. We're setting it now to RS256 by default, with the possibility to override. Just wanted to make sure that's what is intended..?