OAuth base class

1. This abstracts common protocol operations into a series of base classes (see Facebook, Google, Microsoft), reducing duplicate code and making it easier to implement other providers.
2. The base class can be used directly to access other auth providers. See the GitHub sample in Startup.cs. Because resolving user information is not part of the OAuth protocol, that step must be left to the developer (see OnGetUserInformationAsync notification). If they don't, by default we will put the access token into the ClaimsIdentity for the application to utilize later.
Or an `IReadOnlyDictionary<string, string[]>` if it's available in CoreCLR.

Either way, we should ensure the adopted solution works with JSON payloads containing arrays or objects values (that's why directly using the `JObject` instance is more flexible). If it doesn't, you could consider manually creating an empty `JObject` value or a `JObject` populated with the parameters extracted from the response body in the FB handler.