Add edX OAuth2 provider with OpenID Connect support

This call to get all of the accessible courses is going to always be made twice, right? Once for the scope, and once for the claim? Does it make sense to memoize the result for the request? What's the lifecycle of the `CourseAccessHandler` object?