fix potential information leakage

- move non-final static members and static methods of OathObject to
  newly create OathList class
- create a singel OathList instance for the yubico applet
- change OathObject creation to require list as parameter
- remove asserts from test that checked the leaked state