Add initial spec for auth service

This is a draft based on some combined ideas from the OAuth toy code bases that have been used for experimentation:  https://github.com/mark-burnett/oauth-skeleton and https://github.com/iferguson90/oauth-toy.

It is not complete and may require significant changes to get it closer to what we want.
Do we want to support basic HTTP authentication for the authorization endpoint?