Make Pac4JCallbackHandler a bit extendable

This just pulls error handling, finding a client given a request and handling
a successful authorisation into protected methods that can be overridden,
rather than forcing users who need custom logic to duplicate the entire login
flow.