Refactor OAuth so that it doesn't require private keys when we aren't signing anything

Now, we can safely use bearer tokens or "none" alg without guice crapping out. I also refactored naming of things.

As always in this api, there's more shoveling to do, but this is certainly a step forwards cognitively and also from a tech debt pov.

replaces #87

 * Refactor OAuth so that it doesn't require private keys when we aren't signing anything.
 * Rename constant `serviceAccountCredentials` to `p12PrivateKeyCredentials` as this better describes the credential value.
this is the trick! using a supplier, you shield other valid config like bearer token from a tree of deps!