Use golang/oauth2@2e27b6b6c

because golang/oauth2@0ae3d4edc99f765dc1513a9605aa96e82877a20a breaks
compatibility around Extra fields.

- https://github.com/martini-contrib/oauth2/pull/36
- https://github.com/typester/gate/pull/9
add commit locks